Built it with Lovable, Bolt, Replit, Cursor, or v0? Check the launch risks first.
Before real users touch your app, TaskBounty reviews your public repo's GitHub Actions and CI/security hygiene, then helps turn findings into reviewed fixes. For private repos, your source stays in your environment.
Public data only. No app is run and no workflow is triggered. Sensitive candidates are never published.
Prefer to check it yourself first? Grab the copy-paste security prompts. Need the full launch flow? Use the pre-launch checklist.
Already ran a check? Request a free 20-minute launch-safety review to interpret or fix the results.
Check a repo from your terminal
npx taskbounty-check@latest .Runs locally and checks GitHub Actions + CI hygiene. It writes a local report and does not upload source code or workflow contents.
Want it inside your workflow? Copy the Cursor, Claude, Codex, and GitHub Actions snippets.
It is not a full app security audit: secrets, auth, payments, webhooks, and runtime behavior still need a manual review. For help turning findings into fixes, request a confidential review.
The free check is public-repos only. For private repos we run a confidential review — your choice of method.
Which check do I need?
Check my live app
Scan a deployed URL for what it leaks to any visitor: exposed keys, open databases, reachable files.
Free instant scan →
Check my repo / CI hygiene
Review your GitHub Actions and repository config for security gaps in how you build and ship.
Repo & CI check →
Get it fixed
We verify the issues, fix them, and prove the fix in a reviewable pull request.
See packages →
Run the check from your coding agent
One-off local scan. Writes a local report; no network by default, nothing uploaded.
npx -y taskbounty-check@0.1.6 .Local by default: it reads only your GitHub Actions / CI files, makes no outbound requests, and uploads nothing. Pin the version (@0.1.6) in committed config and CI for reproducibility. Scope is workflow / CI hygiene, not a full application-security audit.
Once it surfaces findings and you want a human to interpret or fix them, you can request a free launch-safety review.
What this check covers
Third-party actions pinned to a movable tag, broad workflow token permissions, and missing permissions blocks.
Whether Dependabot or Renovate is keeping your CI dependencies current.
Workflow patterns whose security implications depend on context — flagged for a private review, never published.
What it does not check (yet)
We only claim what we actually test. This public check does not look at:
- Exposed secrets in your code (run the local check for that — source never leaves your machine).
- Auth, payment, and webhook logic — these need a manual review, which we recommend before launch.
- Runtime behavior or live endpoints. This reads public repo configuration only; no app is run and no workflow is triggered.
Need a private-repo review where source never leaves your machine? See the confidential review.
What you receive
- A plain-language launch-readiness summary of what was reviewed.
- Findings grouped by category, with the evidence we observed.
- Honest labels: observed fact, candidate to review, or recommended practice. Nothing is called a confirmed vulnerability.
- A shareable report link. Reports are unlisted by default.
Turn findings into fixes
After you authorize a deeper review, we confirm scope, privately review any sensitive candidates, and propose focused changes as reviewable pull requests for your approval. Nothing is opened or changed automatically. See Security Hardening and the methodology for our safety boundaries.
Security checklists by AI builder
Each workflow is slightly different. Pick the one that matches how you built the app.