Free app health check
Paste the URL of your live Lovable, Bolt, Cursor, Replit or v0 app. In a few seconds we check the basics that AI-built apps most often get wrong, and explain each result in plain English.
Results
Want it fixed, not just flagged?
This check only looks at the outside of your app. The free full scan also reviews your repo: Row Level Security, table grants, auth flows, payments and webhooks. Or skip ahead: the $199 Fix covers up to 5 issues, delivered as a tested pull request within 72 hours. Not fixed, full refund.
What we check
- HTTPS: is traffic to your app encrypted?
- Security headers: Content-Security-Policy, HSTS, clickjacking protection (X-Frame-Options / frame-ancestors) and X-Content-Type-Options.
- Public source maps: can anyone download your original source code?
- Secret keys in your JavaScript: Supabase
service_role/sb_secret_keys, Stripe live keys, AI provider keys and similar patterns. We never show the full key, only the first few characters. - Supabase usage (informational): whether your app talks to Supabase with a public key, which is normal but means Row Level Security has to be right.
Want to know exactly which Supabase key your app ships and whether it’s a legacy key? Use the free Supabase key checker.
What this check can’t see
It’s a quick look from the outside, not an audit. It can’t see your database rules, server code, private pages or anything behind a login, and a clean result isn’t a guarantee. Most serious problems in vibe-coded apps (missing RLS policies, table grants, broken payment webhooks) live in places only a repo scan reaches.
FAQ
Is the health check free?
Yes. It costs nothing and needs no account. Paste the URL of your live app.
Is it safe to run on my app?
We make a few ordinary read-only requests, the same files a browser downloads. No logins, no attacks, no load testing. Only check sites you own or are allowed to test.
What does it check?
HTTPS, security headers (Content-Security-Policy, HSTS, clickjacking protection and X-Content-Type-Options), public source maps, secret keys in your JavaScript, and whether your app talks to Supabase with a public key.
Will it show my full secret key if it finds one?
No. We never show the full key, only the first few characters.
Does a clean result mean my app is secure?
No. It’s a quick look from the outside. It can’t see your database rules, server code or anything behind a login. The free full scan also reviews your repo.
Get the free full scan by email
Instant check not working for your app, or want the deeper review? Send us the details and we’ll email you the top issues we find.