Is your app safe to launch?
We check it the way an attacker would, then tell you in plain English what could cost you money, and how to fix it.
Free. No sign-up. We only look at what any visitor can already see.
Anybody who signs up can see other people's records.
Proof, not opinion.
Three findings, exactly as the scanner printed them, from test apps built with the faults we see in the wild. Two could end a business.
Any signed-in user can open your admin screen.
Your "customers" list, which holds email, full_name, phone, has no rules at all about who may read it.
Anyone who finds the address can take the whole thing.
Your customer list has no rules about who may read it.
Your app uses Twilio, which charges you every time. Nothing limits how often a stranger can set that off.
One person running a simple script, at one text message a second, would cost you around 680 dollars a day. Left for a month that is roughly 20,400 dollars, and the invoice is how you would find out.
A stranger can run up your text message bill, with nothing to stop them.
This is not rare.
Real counts, each with where it came from. Nobody counts breaches by who built the app, so the split here is by tool.
Three months of 2026 already beat all of 2025. The tracker began in May 2025, and its researchers estimate the true count is five to ten times higher.
Critical holes in 1,400 apps that researchers examined, plus 400 leaked secrets and 175 apps with customers' personal details sitting in the open.
Of the times an AI was asked to write code, it introduced a security hole, even with a developer at the keyboard. Unchanged since 2025.
Four steps. No developer.
You never touch code. You paste our words into the tool you built with, and it does the fixing.
Paste your address
Nothing to install, nothing to connect. We look at your site the way a stranger with bad intentions would.
Read what is wrong
Each problem in one sentence, what it could cost you, and the proof: what we asked, what we got back, a blanked picture.
Paste the fix
Every problem comes with the exact words to paste into Lovable, Cursor, Bolt, Claude Code or whatever built it.
Check it again
One click re-runs the check that found it and tells you, plainly, whether it is gone. Then we keep watching.
What we will never do.
A security check you cannot trust is worse than none. These are not settings; they are how the product is built.
- ×Change anything in your app. A free check only reads what a visitor could already see.
- ×Keep your customers' data. A finding holds a count, a list of column names, and one sample blanked past its first two letters. Nothing else is stored.
- ×Say "all clear" when we could not check. If a check could not run, the report says so, in those words, instead of showing green.
- ×Run a test that could change your data without you switching it on, on its own screen, after proving the site is yours.
- ×Show you a key you gave us, ever again. It is locked away and used only for the checks it unlocks.
- ✓Prove every finding. A problem is only reported once a check has actually seen it; a guess never reaches you.
- ✓Write for you, not for a developer. If a sentence needs a dictionary, it is a bug on our side.
- ✓Tell you what it costs before what it is. The consequence comes first, every time.
- ✓Lead with what you fixed when you check again, because that is the half nobody tells a founder.
See it free. Pay for the fix.
A free check shows you everything that is wrong. Paying shows you how to fix it, in words to paste. No card to see the problems.
The free check
Every plan starts here. Paste your address and see everything that is wrong, with the proof, in plain English.
- No card, no sign-up
- One site, one page
- Tells you if a problem is still there when you check again
One site you want kept an eye on, not just fixed once.
- Everything in the free check, plus:
- How to fix every problem, in words you paste into the tool you built with
- Prove the site is yours, which turns on the checks only an owner may run
- We check your site again every week, on our own
- We tell you if it goes down, or your web address is about to run out
- Email and Slack the moment something changes
- Ten pages of your site instead of one
A real business with real customers and something to lose.
- Everything in Solo, plus:
- We check every day instead of every week
- We sign in as a test customer and photograph what they can reach, every word blanked
- You can connect a key so we run the checks only an owner can run
- Five sites, thirty pages of each
- A hundred and fifty checks a month
You build for other people and want every site you ship covered.
- Everything in Business, plus:
- Twenty sites instead of five
- Fifty pages of each site
- Six hundred checks a month across all of them
Nothing here is a different kind of check. It is the same Business plan with room for a portfolio: every client site watched daily, each with its own report and its own score page to hand over.
Start with a free checkLaunching soon and would rather not subscribe?
Launch Check$29 once, for one site
Everything Solo unlocks, for one site, for thirty days. You fix what is wrong, check your work, and that is the end of it. It does not watch your site afterwards.
Every plan starts the same way: a free check of your site, with no sign-up. You choose a plan from inside your results, and you can cancel a monthly plan whenever you like. Prices shown are our published list; the checkout shows the current price before you pay. See everything each plan includes →
What founders ask us.
I built my app with Lovable, Bolt, Cursor or Claude Code. Is this for me?
Yes, that is exactly who it is for. Those tools make apps that work, and quietly leave doors open that you cannot see because nothing looks broken. We find the doors, explain them without jargon, and give you the words to paste back into the same tool to close them.
Is the free check really free? What is the catch?
It is free, with no sign-up and no card. You see everything that is wrong, in plain English. What you pay for is how to fix it: the exact words to paste, the re-check, and the watching. We would rather you see the problem for free than not see it at all.
Could the check break my site?
No. A free check only reads what any visitor could already see, the same pages and the same public addresses. Anything that could change data is off unless you prove the site is yours and switch it on yourself, on a screen that says exactly what it does.
What do you do with what you find?
We keep a count, a list of column names, and one sample blanked past its first letter, so you can see it is real without us holding anything private. We never store your customers’ data. A picture of a leaking screen is taken with every word blanked before it is saved.
What if you could not check something?
The report says so, in those words. A check that could not run is never shown as a pass, because an all-clear you did not earn is the most expensive thing a scanner can give you.
I do not know how to code. Can I actually fix what you find?
That is the point of the paid part. Every problem comes with the words to paste into the tool you built with, written for that tool. You paste, it fixes, you press "check again", and we tell you plainly whether it is gone.
Which app builders and databases do you understand?
Any public website gets the full outside check. The deeper checks, the ones that look at your database rules and what a signed-in user can see, are built around Supabase, which is what Lovable, Bolt and most AI tools use underneath. If your app runs on something else, the free check will tell you what it could and could not look at.
What is the difference between the Launch Check and Solo? They cost the same.
They unlock exactly the same things. The difference is what happens afterwards. The Launch Check is a one-time payment: you fix what is wrong, you have thirty days to check your work, and then it ends and you are back to the free check.
Solo is that same thing, continuing. On top of it we re-check your site every week ourselves and tell you the moment something changes, for as long as you stay.
Launching once and then leaving it alone? Take the Launch Check. Have customers using it every day? Take Solo.
Can I cancel?
Any monthly plan, any time, from your own billing page, and it stays on until the end of what you paid for. The Launch Check is a one-time payment for thirty days and does not renew.
Find out before a customer does.
Check my site, freeAbout a minute. No sign-up. We only look at what any visitor can already see.