Built for Lovable · Bolt · v0 · Replit · Cursor

Ship your AI-built app without leaking the keys.

Paste a URL. See every secret, open database table, and missing header — free, no email wall. Unlock copy-paste fix prompts for your builder for $9. Free re-scans until you're green, or your money back.

~20 seconds · read-only

How it works

Three steps. No account.

1

Paste your live URL

We only fetch your page and its own JavaScript. No login, no crawling the rest of the internet, no storing of row data.

2

See every problem free

Leaked API keys, Supabase tables readable without login, open Firebase rules, exposed .env / .git, missing security headers, basic SEO gaps.

3

Unlock fix prompts

One-time $9. Copy a prompt written for Lovable, Bolt, v0, Replit or Cursor, paste it into the chat, re-scan free until the score is green.

Sample findings

What a report looks like

Titles and severity are free. The fix prompts stay blurred until you unlock.

Critical

Supabase table "profiles" is readable without login

anon key HEAD returned HTTP 200

fix →
Critical

OpenAI API key in client code

Found in page or JS bundle · sk-p…8f2a

fix →
Medium

Missing Content-Security-Policy header

No CSP header on the document response

fix →

Pricing

Simple, one-time. No subscription.

Most popular

$9 one report
  • Full report with severity + evidence
  • Copy-paste fix prompts for your builder
  • Free re-scans of this app until it's green
  • 7-day no-questions refund
Scan free, pay only to unlock

For agencies & builders

$29 10 reports
  • Everything in the $9 plan
  • Unlock any 10 reports
  • Credits never expire
  • 7-day no-questions refund
Start with a free scan
Our guarantee. The only scanner that guarantees you end up fixed: no email wall, fix prompts for your builder, free re-scans until you're green — or your $9 back.

FAQ

Questions, answered

Is the scan safe? Do you store my data?

Yes — it's read-only. We fetch your public HTML and same-origin JavaScript, probe public API endpoints with the keys already in your page, and never write to your app. We never store database row contents or full secret values (only a masked preview like sk-p…8f2a). Reports auto-expire after 30 days.

Do I need an account or to give you my email?

No. Results show immediately. Email is optional ("email me this report") and only used to send that report plus a short 3-email follow-up. No spam, no selling.

What builders do you support?

Fix prompts are written for Lovable, Bolt, v0, Replit and Cursor. Other stacks still get a generic, paste-into-any-AI prompt.

What if I don't get to green?

Email us within 7 days of payment for a full refund, no questions asked. See the refund policy.

Can I scan someone else's app?

Only if you own it or have written permission. Every scan requires that checkbox. Unauthorized scanning is a terms violation.