Your app is live. Run a free security scan for exposed data and secrets.
We run a permission-based security check on your AI-built app, confirm the real issues, and fix them only after your approval.
Read-only by default. No login. No customer data downloaded. No changes without approval.
Built for apps shipped with
What happens after you submit
No surprises. Permission first, a human in the loop, and your approval before anything is touched.
You submit your app URL
Paste the link and confirm you control the app.
We confirm scope
We agree on what is in and out of bounds before anything runs.
Read-only scan
We check only what a browser already downloads, from the outside.
Eliott reviews
Every finding is checked by a human before it leaves the building.
Plain-English report
You get exactly what is exposed, why it matters, and how to fix it.
You approve fixes
Nothing is changed until you say so. The scan is yours to keep.
What we check
Every finding fires only on a real, verifiable pattern, so the report is high signal and low noise. If something cannot be confirmed, we say so.
Secrets in the frontend
- Supabase service_role / sb_secret keys in the browser
- Stripe, OpenAI, Anthropic, AWS, Google, GitHub keys
- Private key blocks and tokens in JS bundles
Supabase and Firebase
- Live row-level-security check (which tables your public key can read)
- Public Storage buckets and anon-callable functions
- Open Firebase Realtime Database
API exposure
- Public GraphQL introspection on your backend
- Public OpenAPI / Swagger schemas
- Config endpoints scanned for real secrets
Exposed files
- .env files, .git directory, .npmrc, lockfiles
- Public source maps that reveal your source
Transport and headers
- HTTPS enforcement and TLS certificate health
- Security headers and cookie flags
- Dangerous CORS and mixed content
Storage and access
- Public buckets and signed-URL gaps
- Open signups and over-permissive policies
- Version disclosure
A sample report
An anonymized example of what you receive. Plain English, every issue verified, with the fix.
App Safety Report
example-app.lovable.app
| Severity | Finding | Status | Fix |
|---|---|---|---|
| Critical | Supabase service_role key exposed in the frontend | Confirmed | Remove from the bundle, rotate the key |
| High | Row-level security off on users, orders, messages | Confirmed | Enable RLS, add per-user policies |
| Pass | HTTPS enforced, valid certificate | Clean | No action |
| Pass | No .env, .git, or source maps reachable | Clean | No action |
Prepared by Eliott, TaskBounty. Sample, anonymized. Real reports include exact, step-by-step fixes.
Not a pentest. A practical safety check.
This is a fast, focused review of the issues that actually bite fast-built apps, not a multi-week manual audit.
| Traditional pentest | TaskBounty safety scan | |
|---|---|---|
| Time | Weeks of manual testing | Fast initial review |
| Cost | Expensive engagement | Free scan, pay only for fixes |
| Output | A long PDF | A short, fix-oriented report |
| Scope | Broad manual testing | Focused on common AI-app exposures |
| Outcome | Usually report-only | We can fix it after your approval |
Verify it, fix it, prove it is closed
Pick the depth you need. Verify confirms your access boundaries in a report, Fix closes the findings in a reviewable pull request, and Fix + Proof adds before-and-after sandbox evidence.
Verify
$149 one-time
For teams with an unclear or unverified security posture.
- Authenticated verification of your access boundaries, with two throwaway test users where applicable
- Confirms whether a real user can reach another user's data
- A short report with reproduction notes and a risk level. No code changes
Fix
$499 one-time
Everything in Verify, plus we close the issues.
- We implement the fixes for the confirmed findings
- Delivered as a reviewable pull request you approve and merge
- Covers common exposed-secret, open-database, RLS, header, source-map, .env, and .git issues
Fix + Proof
$999 one-time
Everything in Fix, proven before you trust it.
- We prove the fix in an isolated sandbox with before-and-after evidence
- You see exactly what was open and that it is now closed
- Full refund if we miss a verified issue
How the deep check works
The full path runs from Verify through Fix + Proof. Verify ends at the report, Fix adds the pull request, and Fix + Proof adds the sandbox evidence.
- 1We verify the issue safely, read-only or with test accounts you provide.
- 2We fix it in a branch and open a reviewable pull request.
- 3We prove the fix in an isolated sandbox, with before-and-after evidence.
- 4You review and merge. Nothing of ours runs in your pipeline.
What you take away depends on the level: Verify ends in a written report, Fix and Fix + Proof end in a reviewable pull request you approve and merge, and Fix + Proof adds before-and-after sandbox evidence. Every level is verified safely, and nothing of ours runs in your pipeline.
Free scan first. Pay only if you want us to fix it.
The scan and the report are free. You only pay if you want us to fix the confirmed issues.
Free Safety Scan
$0Read-only scan plus a human-reviewed, plain-English report. No card, no commitment.
Want us to fix it? See the Verify, Fix, and Fix + Proof packages above.
Safe by default
How the scanner behaves, and what it never does.
Read-only checks
The scan reads only what a browser already downloads from your app. It never logs in on the public path.
No destructive probes
The public scan never writes, never changes data, and never runs a write test. Write checks only ever run in the deeper check you explicitly authorize.
Redacted findings
Any sample evidence is redacted before you see it. We do not store or display your users' data.
Rate limited
Scans are limited per visitor and per target, so the scanner is never used to hammer an app.
SSRF guarded
Every URL is validated and resolved, and private, internal, and metadata addresses are blocked.
No public disclosure
Findings are private to you. We never publish them or share them without your say-so.
Found something and not sure it is safe to share? Responsible disclosure is welcome at security@task-bounty.com.
Typical issues we catch
The same handful of mistakes show up again and again in fast-built apps. These are the ones that expose real user data.
Before and after, verified in a sandbox
Every Fix + Proof engagement ships this: the exact issue while it is open, and the same check passing once it is closed.
Anon key can read the users table
GET /rest/v1/users -> 200 OK
[ { "email": "j•••@•••.com", "role": "admin" }, ... 4,812 rows ]Row Level Security is off, so any visitor's key reads every row.
RLS enabled, anon read blocked
GET /rest/v1/users -> 200 OK [ ] 0 rows returned to the anon key
A policy scopes rows to their owner, and a re-run in an isolated sandbox confirms it is closed.
Illustrative and redacted. Your report shows your own before-and-after.
What this is not
- A full penetration test. We do not exploit, pivot, or hand-test business logic and auth flows.
- A compliance certification. We do not issue SOC 2, ISO, HIPAA, or PCI attestations.
- An incident-response retainer. If you are actively breached, contact a specialist.
- A guarantee that every possible vulnerability is found. We report confirmed, verifiable issues only.
Questions
Can this break my app?
No. The default scan is read-only. It does not log in, does not write to your database, and does not change any code.
What data can you access during a scan?
Only what a browser already downloads, plus outside-in checks that use counts, never your actual rows. We never log in and never download your data.
Do you need GitHub access?
Not for the free outside-in scan. Fixes may require repository access later, only with your approval.
Do you scan production?
Yes, only with explicit permission and only within the scope we agree on first.
Do you store customer data?
No. The scan checks exposure patterns and counts, not customer rows.
What happens if you find something critical?
You get a private report with the issue and recommended fix steps. Nothing is ever disclosed publicly.
How often do you scan if I am on monitoring?
Weekly scheduled scans, plus a re-scan after a major release on request. You get a regression alert the moment something changes and a clean monthly report.
What does a hardening price cover?
Only the confirmed findings in the agreed report. New features, architecture changes, incident response, and compliance work are quoted separately.
Get your free safety scan
Paste your app URL and confirm you control it. We will review the scope, run a read-only scan, and email you a human-reviewed report. No card, no login, nothing changed without your approval.
Prefer email? Reach Eliott directly at eliott@gettaskbounty.com.