Guides

Checks for AI-built apps

Each guide matches a search someone makes before they ship. The scan behind them is the same passive check as the homepage: public responses only, for an app you own or are allowed to test.

• Lovable security check

  Paste a Lovable app URL you own. The free scan reads the public page, same-origin scripts, headers, and a few files that should not be online.

• Bolt app security check

  Run a passive check on a Bolt app URL you own. We look at the public page, its scripts, headers, cookies, and a short list of files.

• Cursor app security check

  Scan the deployed URL of an app built in Cursor. The check reads the live page and public files, not the editor or your local .env.

• Replit app security check

  Check a Replit app URL you are allowed to test. We fetch the public page, same-origin scripts, headers, and five well-known paths.

• Supabase security check

  See if a Supabase service_role key is in the public bundle. This scan does not read Row Level Security policies or query your database.

• Firebase security rules check

  We can see a Firebase web config in the public page. We cannot read Firestore, Realtime Database, or Storage rules.

• Exposed API key check

  Look for API keys in a public page, its same-origin scripts, and a few files that should 404. The raw key is not stored.

• Security headers check

  See which security headers a public page is missing, including CSP, HSTS, framing protection, nosniff, and Referrer-Policy.