Free instant scan
See what your app leaks to any visitor
Paste your app URL. We read only what a browser already downloads and check your database access from the outside, then show you exactly what is exposed. No login, no writes, free.
A sample of what you will see
Row Level Security is off, so any visitor's key can read every row.
{ "email": "j•••@•••.com", "stripe_customer_id": "cus_••••" }Sample row, redacted. We never store your data.
What happens after the scan
Clean
No outside-in issues found.
Run the deeper authenticated check to prove who can read whose data.
Finding
Exposed keys or open data found.
Fix it and get a reviewable PR, proven in an isolated sandbox, from $149.
Unknown RLS
Database found, access unverified.
Verify Row Level Security with two throwaway test users.
What the instant scan looks for
- Exposed Supabase / Stripe / OpenAI / AWS keys in the browser bundle
- Open Supabase or Firebase databases your public key can read
- Reachable .env, .git, and source-map files
- Missing HTTPS, weak headers, and dangerous CORS
JavaScript and TypeScript apps today. The instant scan is passive and outside-in. How the scanner stays safe.
Scan by platform and check
The scan works on any JavaScript or TypeScript app. These pages cover the platform and the specific leak you are worried about.
Go deeper
The scan above cannot log in. The worst leak is the one that needs a login.
The single most common real breach in vibe-coded apps is broken access control: one logged-in user reading another user's data. A passive scan cannot see it. Our deep check logs in as two real test users and proves exactly who can read whose records, then hands you a fix, verified in an isolated sandbox, as a reviewable PR. Full refund if we miss.
Fixing a finding starts at $149 (Verify). Full refund if we miss a confirmed issue.
Questions
Is the scan safe to run on my app?
Yes. It is read-only and outside-in: it reads only what a browser already downloads and checks your database access from the outside. It never logs in, never writes, and never runs a write test.
Do I need to give you access or log in?
No. Paste your live app URL. The free scan needs nothing else. A later fix may need repository access, only with your approval.
Which apps does it work on?
Deployed JavaScript and TypeScript apps reachable at a public URL, including apps built with Lovable, Bolt, v0, Replit, and Base44, on Supabase or Firebase backends.
What does it cost to fix what the scan finds?
The scan is free. If you want us to fix a finding and prove the fix in a reviewable pull request, that starts at $149, with a full refund if we miss a confirmed issue.
Which check do I need?
Check my live app
Scan a deployed URL for what it leaks to any visitor: exposed keys, open databases, reachable files.
Free instant scan →
Check my repo / CI hygiene
Review your GitHub Actions and repository config for security gaps in how you build and ship.
Repo & CI check →
Get it fixed
We verify the issues, fix them, and prove the fix in a reviewable pull request.
See packages →