Your app works. Can a stranger read your users' data?
Built it with Lovable, Bolt, Replit, Cursor or Claude? We check where it can be broken into, explain it in plain language, and give you prompts to paste back into your AI tool to fix it.
3 problems found
- Critical
Anyone can read your whole users table.
Fix prompt ready to copy - Critical
A secret API key is visible in the page code.
Fix prompt ready to copy - Medium
No limit on sign-up attempts.
Fix prompt ready to copy - Passed
Payments are verified on the server.
Example report, not a real app.
What we look for
Open databases
Supabase or Firebase rules that let any visitor read or delete your users' data.
Leaked keys
Secret keys shipped in the page code, where anyone can copy them and run up your bill.
Missing login checks
Pages and requests that work without signing in, including admin screens.
Payment mistakes
Ways to get the paid plan for free or fake a successful payment.
No rate limits
Endpoints that can be hammered to take the app down or scrape everything.
Launch basics
Outdated libraries, missing backups, missing privacy policy.
How it works
Send your app's address
And confirm the app is yours. We never test apps without the owner's permission.
Get a plain-language report
A grade, the problems ordered by danger, and what each one means for you.
Paste the fix prompts
Each problem comes with a prompt for your AI tool. Fix, re-check, ship.
Questions
Is it really free?
The first 20 checks are free and done by hand while we build the automated version. In return we ask for honest feedback.
Do you need access to my code?
Not for the first check: we look at what your app already shows to any visitor. A deeper check with read-only access to code is optional.
Does a good grade mean my app is secure?
No check can promise that. A good grade means the common, easy-to-exploit mistakes are not there.
Which tools do you support?
Any web app, whatever built it. We know the typical mistakes of Lovable, Bolt, Replit, v0, Cursor and Claude Code best.