Is your app safe to launch?
We check it the way an attacker would, then tell you in plain English what could cost you money, and how to fix it.
Free. No sign-up. We check the one page you give us, and only what any visitor can already see.
Two checks. One is free.
Both look for more than a hundred specific problems, across nine departments. The free one looks at your site from the outside and takes about a minute. The paid one reads your code, where the expensive mistakes are. Those never show on the site.
What anyone can reach right now.
We open your site the way any visitor can, and we read the code your app sends to their browser. That finds a database left open to the public, a password sitting in the page, and old parts with known holes in them.
- Nothing to install, nothing to connect
- Answers in about a minute
- Finds what is already exposed right now
The faults your site never shows.
You point us at where your code lives, and we read the part that runs on your server. Nothing outside your app can see that part, ours included. It is where you find a charge with no limit on it, or a limit a visitor can step around.
- Found before launch, not on the bill
- Reads the pages a visitor only reaches after signing in
- Comes with the words to paste in to fix it
Start with the free one. It is the same scanner, and most people find something. Add the code check when you want to see what your site cannot show you.
Proof, not opinion.
None of these are your site. They are three findings, exactly as we printed them, from test apps we built with the faults we see in the wild. Two could end a business.
Any signed-in user can open your admin screen.
Your "customers" list, which holds email, full_name, phone, has no rules at all about who may read it.
Anyone who finds the address can take the whole thing.
Your customer list has no rules about who may read it.
Your app uses Twilio, which charges you every time. Nothing limits how often a stranger can set that off.
One person running a simple script, at one text message a second, would cost you around 680 dollars a day. Left for a month that is roughly 20,400 dollars, and the invoice is how you would find out.
A stranger can run up your text message bill, with nothing to stop them.
It found one of ours.
In September 2026 our own check read our own code and found a fault in it. Here is what it said, and what it had cost us.
You limit how many free checks one visitor can run. To tell visitors apart, you trust a name that the visitor's own browser fills in.
A visitor can put anything in that name. Change it, and the count starts again at zero. So the limit stops nobody.
Our own limit on free checks stopped nobody.
This is the whole case for reading the code. A check from outside told us we were fine, because from outside we looked fine. The fault was one line, in a file no visitor can reach, and it was quietly handing out free checks that we were paying for.
Not a survey. We ran it.
In October 2026 we scanned 50 real apps other people built with Lovable and Bolt, and read the code of the 47 still public. This is what came back.
38 in every 100 had a key anybody reading their code could copy and use as though they were them.
Something they pay for per use, with nothing limiting how often a stranger can set it off. The invoice is how you find out.
What somebody typed into a box ends up somewhere it can do more than fill in a form.
What this does not say. Of the 50, only 6 had a site we could reach and a database we could ask, and 1 of those 6 were readable by a stranger. The other 44 were not examined, and we do not count them as clean.
Read how we did itHow the 50 were chosen, what we did to each one, and the three things these numbers cannot tell you.
This is not rare.
Other people's counts, each with where it came from. Nobody counts breaches by who built the app, so the split here is by tool.
Three months of 2026 already beat all of 2025. The tracker began in May 2025, and its researchers estimate the true count is five to ten times higher.
Apps found holding sensitive company or personal data, among 380,000 that anyone could open without signing in. Inside were patient conversations, bank records and shipping routes.
Of the times an AI was asked to write code, it introduced a security hole, even with a developer at the keyboard. Unchanged since 2025.
Four steps. No developer.
You never touch code. You paste our words into the tool you built with, and it does the fixing.
Paste your address
Nothing to install, nothing to connect. We look at your site the way a stranger with bad intentions would.
Read what is wrong
Each problem in one sentence, what it could cost you, and the proof: what we asked, what we got back, a blanked picture.
Paste the fix
Every problem comes with the exact words to paste into Lovable, Cursor, Bolt, Claude Code or whatever built it.
Check it again
One click re-runs the check that found it and tells you, plainly, whether it is gone. Then we keep watching.
What we will never do.
A security check you cannot trust is worse than none. These are not settings; they are how the product is built.
- ×Change anything in your app. A free check only reads what a visitor could already see.
- ×Keep your customers' data. A finding holds a count, a list of column names, and one sample blanked past its first two letters. Nothing else is stored.
- ×Say "all clear" when we could not check. If a check could not run, the report says so, in those words, instead of showing green.
- ×Run a test that could change your data unless you switch it on yourself, after you have proved the site is yours.
- ×Show a key back to anyone, you included. It is encrypted, used only for the checks it unlocks, and deleted the moment you remove it.
- ✓Prove every finding. A problem is only reported once a check has actually seen it; a guess never reaches you.
- ✓Write for you, not for a developer. If a sentence needs a dictionary, it is a bug on our side.
- ✓Tell you what it costs before what it is. The consequence comes first, every time.
- ✓Lead with what you fixed when you check again, because that is the half nobody tells a founder.
- ✓Ask for the least we can work with. Reading your code is an install you approve on GitHub and can take back there, not a key you paste.
See it free. Pay for the fix.
A free check shows you everything that is wrong. Paying shows you how to fix it, in words to paste. No card to see the problems.
more than a hundred specific problems, on every plan: Can a stranger get in? · Can somebody run up my bill? · Is my site still up? · If something breaks, is my data gone? · Am I losing people because it is slow? · Can everyone use it? · Is it built properly? · Can anyone find me? · Do AI assistants know I exist? Everything we look for →
The free check
Every plan starts here. Paste your address and see everything that is wrong, with the proof, in plain English.
- No card, no sign-upYou see the result before you tell us who you are.
- Every problem we find, in plain EnglishNot a checklist. What is wrong, and what it could cost you.
- One site, one pageEnough to know whether you have a problem. Not enough to find all of them.
- Five checks a monthFix something, press the button again, and we tell you plainly whether it is gone.
Launching soon and would rather not subscribe?
Launch Check$19 once, for one site
The words to fix every problem, a read of the code that built it, and the deeper checks, for one site, for thirty days, with fifteen extra checks to fix things and prove they are fixed. It does not watch your site between checks.
One site you want kept an eye on, not just fixed once.
- Everything in the free check, plus:
- How to fix every problem, in words you paste inYou copy our sentence into Lovable, Cursor or whatever built the site, and it does the work. You never open the code.
- We read the code that built your appA bill with no limit on it does not show up on your web address. It shows up on your card. We take a copy of your code, read it, and delete it when the scan finishes.
- Fix it without leaving the tool you built withConnect us to Lovable, Cursor, VS Code or Claude Code once, then say "check my app and fix what you find" inside the tool you already use. You stop copying anything between two windows.
- Prove the site is yours, which turns on the deeper checksSome checks are too intrusive to run on a stranger. Once you have shown the site is yours, we run them.
- We check again every week, without being askedMost problems arrive with a change you made on a Tuesday, not on the day you signed up.
- We tell you if it goes down, or your web address is about to run outAn expired address takes your site off the internet, and the email about it usually goes to an inbox nobody reads.
- Email and Slack the moment something changesYou hear it from us, not from a customer.
- We go looking for your other pages, not just the one you pasteThe page that leaks is rarely your home page. It is the one behind a link you forgot about.
Also included:
- A separate report you can hand to a developer
- Fixes you paste straight into the tool you built with
- A short summary of your site every week
- Thirty checks a month, about one a day, so you can fix and re-check freely
- Need a second or third site? Add up to two more for $15 a month each
A business with more than one site, a team, and data worth a second lock.
- Everything in Solo, plus:
- A page of scores, in your name, to send anybody who asksWhen a customer, an investor or a marketplace asks whether your app is safe, you send a link instead of writing a paragraph you are not sure of.
- Invite two other people to read your reportsThe person who can actually fix things sees the problem and the words to paste, without you forwarding a PDF or sharing your password.
- Safe to hand to a freelancerThey see every problem and the exact words to fix it, and can change nothing: not your billing, not your plan, not your sites. Give a contractor access on Monday and there is nothing to undo on Friday.
- We check every day instead of every weekA problem introduced on Monday is found on Monday, not the following weekend.
- We sign in as a test customer and photograph what they can reachThis is how we find one customer being able to read another customer's data, which no check from outside can see. Every name, email and number in the picture is blanked.
- Five sites instead of oneEnough for a business with a main site, a landing page or two, and something half-finished you forgot was public.
- Record what was true on the day you hand a site overA permanent page at its own address, carrying your name. If the site is breached a year later, the argument is about what was true when you handed it over, and this is the only thing that answers it.
Also included:
- The deeper checks that need you to connect your project, once you do
- Three hundred checks a month: every site watched daily, with room to re-check
- Need more people? Add up to eight more for $5 a month each
In Solo and Business
Fix it without leaving the tool you built with
Connect GuardCue once, then ask for a check inside the tool you already use. It tells your tool what is wrong and the exact words to fix it, then checks again to prove the fix worked.
- Works where you built itLovable, Cursor, VS Code and Claude Code, with Bolt, Replit and Base44 coming soon.
- No key to copy or keep safeYou sign in with your email and press Allow. That is the whole setup.
- Honest about what it could not checkSo your tool never tells you that you are safe when we simply do not know.
- It reads, it never writesYour tool makes each change, with you watching. Disconnect it whenever you like.
Building sites for other people?
Agencies need things a founder does not: a client seeing only their own site, reports in your name rather than ours, and a record of what was true the day you handed a site over. Tell us how you work and we will price it around that.
Every plan starts the same way: a free check of your site, with no sign-up. You choose a plan from inside your results, and you can cancel a monthly plan whenever you like. Prices include tax, so the price you see is the price you pay. See everything each plan includes →
What founders ask us.
I built my app with Lovable, Bolt, Cursor or Claude Code. Is this for me?
Yes, that is exactly who it is for. Those tools make apps that work, and quietly leave doors open that you cannot see because nothing looks broken. We find the doors, explain them without jargon, and give you the words to paste back into the same tool to close them.
Is the free check really free? What is the catch?
It is free, with no sign-up and no card. You see everything that is wrong, in plain English. What you pay for is how to fix it: the exact words to paste, the re-check, and the watching. We would rather you see the problem for free than not see it at all.
Could the check break my site?
No. A free check only reads what any visitor could already see, the same pages and the same public addresses. Anything that could change data is off unless you prove the site is yours and switch it on yourself, on a screen that says exactly what it does.
What do you do with what you find?
We keep a count, a list of column names, and one sample blanked past its first letter, so you can see it is real without us holding anything private. We never store your customers’ data. A picture of a leaking screen is taken with every word blanked before it is saved.
What if you could not check something?
The report says so, in those words. A check that could not run is never shown as a pass, because an all-clear you did not earn is the most expensive thing a scanner can give you.
You want to read my code. Is that safe, and do I have to?
You never have to. Everything on the free check runs from your web address alone, and most people start there and stay there for a while.
If you do let us read it, we take a copy, read it, and delete it when the scan finishes. We do not keep it, we do not train anything on it, and nobody here reads it by hand. What we keep is the finding: a sentence about what is wrong and which file it was in.
It is worth doing because the mistakes that cost the most money live in the part of your app nobody outside it can see. A bill with no limit on it does not show up on your web address. It shows up on your card.
I do not know how to code. Can I actually fix what you find?
That is the point of the paid part. Every problem comes with the words to paste into the tool you built with, written for that tool. You paste, it fixes, you press "check again", and we tell you plainly whether it is gone.
I fixed it, so why does it still say the problem is there?
We check your live site, not the files on your computer. A change only counts once it has been saved to GitHub and your hosting has put it live. Until then the old version is what visitors see, and it is what we see too.
Built with Lovable? Open Publish and press Publish changes. Lovable does not put changes live on its own.
If it has been live for a few minutes and it still shows, the change did not fix it. Ask your tool for the fix again and compare it with what it changed.
Which app builders and databases do you understand?
Any public website gets the full outside check. The deeper checks, the ones that look at your database rules and what a signed-in user can see, are built around Supabase, which is what Lovable, Bolt and most AI tools use underneath. If your app runs on something else, the free check will tell you what it could and could not look at.
What is the difference between the Launch Check and Solo? They cost the same.
They unlock exactly the same things. The difference is what happens afterwards. The Launch Check is a one-time payment: you fix what is wrong, you have thirty days to check your work, and then it ends and you are back to the free check.
Solo is that same thing, continuing. On top of it we re-check your site every week ourselves and tell you the moment something changes, for as long as you stay.
Launching once and then leaving it alone? Take the Launch Check. Have customers using it every day? Take Solo.
Can I cancel?
Any monthly plan, any time, from your own billing page, and it stays on until the end of what you paid for. The Launch Check is a one-time payment for thirty days and does not renew.
Find out before a customer does.
Check my site, freeAbout a minute. No sign-up. We only look at what any visitor can already see. Or read a full sample report first.