First aid for the app you built with AI
Paste your app's link. In under a minute we show what any stranger can already see: leaked keys, files left in public, missing safety settings and broken sign-up links.
We only read public pages and files, the same way a browser does. We never log in, never fill in forms and never read your data. Please check only apps you own or have permission to check.
Example report from a test app we built with deliberate mistakes
Not safe to launch yet: 4 urgent problems to fix first.
Works on apps built or hosted with
- Lovable
- Bolt
- Replit
- v0
- Cursor
- Bubble
- Base44
- Supabase
- Firebase
- Vercel
- Netlify
Any public link works. Not affiliated with these companies.
What the free check looks at
Everything here is visible to anyone who opens your site. If we can see it, so can a stranger.
Leaked keys
Secret keys for Stripe, OpenAI, Supabase, AWS and others sitting in your public JavaScript. We tell public keys (fine) from secret ones (replace now).
Files left in public
Downloadable .env settings files, the .git folder and source maps that hand out your original code.
Browser safety settings
https, HSTS, Content-Security-Policy and the headers that stop other sites from framing your login page.
Sign-up and payment pages
Whether your sign-up, login, pricing and checkout links actually open, or show visitors an error.
Google basics
Leftover "noindex" tags, a robots.txt that blocks everything, default page titles, and missing descriptions or sitemaps.
Your database
We spot when your app uses Supabase or Firebase. Checking whether its tables are open needs you to prove you own the app first.
Every problem, free
The free check names every problem we find, how serious it is, and why it matters in plain English. Evidence is shown with keys partly hidden.
The fixes, for $9
The Fix Pack gives you a copy-paste prompt for each problem, written for the tool you built with (Lovable, Bolt, v0, Replit). One time, per report.
See pricing