Is your vibe-coded app actually locked?
Free Tier A safety check for apps built with Lovable, Bolt, Replit, v0 and Supabase. We look for leaked keys, open databases, and exposed files — then give you plain-English fixes and copy-paste prompts for Cursor or Lovable.
Read-only checks only. We never store secrets or database rows. For app owners (or people with permission). Rate limit: 10 scans per hour per IP.
How it works
1. Paste your URL
We fetch what a normal visitor already gets: HTML, JS bundles, public headers.
2. Safe Tier A checks
HTTPS, security headers, exposed /.env and /.git, secret-shaped strings, Supabase RLS readability (count only), Firebase public reads.
3. Fix in one paste
Every critical finding includes a prompt you can drop into Lovable, Bolt or Cursor.
Pricing
- Tier A scans (rate-limited)
- Plain-English report + fix prompts
- No account required
- 1 verified app
- Weekly automatic re-scans
- Email when something changes
- Login / checkout page health
- 3 verified apps
- Daily scans + Telegram alerts
- Diff vs last scan
- One fix-prompt pack included
FAQ
Is this a penetration test?
No. We only request what a visitor's browser already loads. No password guessing, no exploit payloads, no port scans. Supabase checks use your app's own public anon key and ask for a row count only — we never store table data.
Who should run a scan?
App owners, or people with permission. Our Terms require that. Ownership verification (DNS / meta tag) will unlock deeper weekly monitoring.
What stacks do you support?
Any public HTTPS site. We specially detect Supabase and Firebase configs that vibe-coding tools commonly emit.
How do payments work?
Watch and Guard are on the waitlist. When they open, global cards will go through Dodo Payments; Indian INR through Razorpay.