Check your AI-built app before you launch
Paste your app's address. In about a minute you'll get a plain-English list of what we checked and what our automated checks found. It's free and read-only, and it's not a full security audit. Built for apps made with tools like Lovable, Bolt, Cursor, Replit and v0, including apps that use Supabase.
What the free check looks at
- HTTPS: is the connection encrypted?
- Security headers: whether common browser protection headers are set.
- Exposed keys: whether common secret key patterns (Stripe, OpenAI, Supabase service_role…) appear in the public code we fetch.
- Exposed files:
.env,.gitand source maps anyone can download. - Supabase tables: can the public key read your data? We only count rows and never read them.
Everything is read-only. We only request what any visitor's browser could request. We don't log in, test anything behind a login, or review your server-side code, so a clean result doesn't mean your app is secure.