Is your vibe-coded app actually locked?
Free Tier A safety check for apps built with Lovable, Bolt, Replit, v0 and Supabase. We look for leaked keys, open databases, and exposed files — then give you plain-English fixes and copy-paste prompts for Cursor or Lovable.
Read-only checks only. We never store secrets or database rows. For app owners (or people with permission). Rate limit: 10 scans per hour per IP.
How it works
1. Paste your URL
We fetch what a normal visitor already gets: HTML, JS bundles, public headers.
2. Safe Tier A checks
HTTPS, security headers, exposed /.env and /.git, secret-shaped strings, Supabase RLS readability (count only), Firebase public reads.
3. Fix in one paste
Every critical finding includes a prompt you can drop into Lovable, Bolt or Cursor.
Pricing
- Tier A scans (rate-limited)
- Plain-English report + fix prompts
- No account required
- 1 verified app (meta tag or file)
- Full re-scan every week + summary email: new, fixed, still open
- Instant alert on a new critical issue
- Uptime check of your app + login / checkout pages twice a day
- Dashboard with scan history and fix prompts
- 3 verified apps
- Daily scans + Telegram alerts
- Diff vs last scan
- One fix-prompt pack included
- Step-by-step fixes for your actual host: Vercel, Netlify, Cloudflare, Firebase, GitHub Pages, Lovable…
- Copy-paste config snippets and a Content-Security-Policy starter built from what your page loads
- A verify command for each fix, plus a one-click re-scan
- An AI prompt per finding and one master prompt for Lovable / Bolt / Cursor
- Private link emailed instantly after payment
Tip: run a free scan first and buy from your report — the pack is built from it automatically.
Security guides
Fix the most common problems in Lovable, Bolt, Supabase and Firebase apps yourself.
- Firebase "security rules are defined as public": how to fix it
- How to hide your OpenAI API key in a Lovable, Bolt or React app
- CVE-2025-48757 explained: is your Lovable app exposing data?
- Is the Supabase anon key safe to expose? (publishable key explained)
- Supabase "RLS Disabled in Public" warning: how to fix it
- Supabase RLS policy examples: copy-paste SQL for common tables
- Supabase "Security Definer View" warning: fix views that bypass RLS
- Supabase service_role key exposed? How to rotate it safely
FAQ
Is this a penetration test?
No. We only request what a visitor's browser already loads. No password guessing, no exploit payloads, no port scans. Supabase checks use your app's own public anon key and ask for a row count only — we never store table data.
Who should run a scan?
App owners, or people with permission. Our Terms require that. Weekly monitoring (Watch) only runs on apps whose ownership you've verified with a meta tag or a /.well-known file.
What stacks do you support?
Any public HTTPS site. We specially detect Supabase and Firebase configs that vibe-coding tools commonly emit.
How do payments work?
Checkout runs through Dodo Payments (global cards). Watch ($12/month) and the $49 one-time Fix Pack can be bought today. After a Watch purchase you get a sign-in link by email, add your app, verify ownership and the first scan runs immediately. Cancel any time from your dashboard. Guard is waitlist-only for now. Indian INR via Razorpay comes later.