Is my database readable by anyone?
Apps built with AI tools keep their data in a database, and hand every visitor a public key to reach it. If a table has no rule about who may read it, anyone with that key can read the whole thing.
Free. No sign-up. We check the one page you give us, and only what any visitor can already see.
If we can reach your database from outside, this finds it. If your app keeps its data somewhere we cannot see from the outside, this check will say so rather than pretend it is clear. It reads only; it never changes or keeps your data.
Nobody chooses this. It is what is left out.
The key is not the mistake. It is meant to be public, and every app built this way ships one. The rule about who may read each table is the part that is supposed to stop a stranger, and it is the part an AI tool will happily leave off, because leaving it off is what makes the app work on the first try.
So the app looks finished. Everything loads, nothing errors, and the table holding your customers is one address away from anybody who thinks to ask for it. Nothing in your app tells you, because from the inside it behaves exactly the same either way.
We find your public key the way a visitor’s browser does, then ask each table for its contents. What came back is printed in your report with every value blanked past its first two characters, so you can see it is real without us holding anything private.
Two results, printed as you would get them.
Neither of these is your app. They are the words our own checker prints, on test apps we built with the faults we see in the wild.
Your "bookings" table, which holds name, email, phone, address, has no rules at all about who may read it.
Anyone who finds the address can take the whole thing, all 2,140 rows, without signing in.
Your bookings list has no rules about who may read it.
Anyone can copy everything in your "recipes" table without logging in, all 318 rows.
If this is public information like a product list, that is fine. If it is data you built or paid for, someone can take the whole thing.
Your recipes table is readable by anyone, and that is probably fine.
It says yes. Now what?
The fix is one rule per table, and it is minutes of work once you know which tables are wrong. The hard part is knowing that, which is what the free check gives you: every open table, what is in it, and which ones actually matter.
What you pay for is the other half. The exact sentence to paste back into Lovable, Bolt, Cursor or whatever built the app, written for that tool, and a re-check that tells you plainly whether it worked. You never open the code.
The questions people ask.
- Is it dangerous to give you my web address?
- No. We only ever ask your app for things any visitor’s browser could ask for, using the key your app already hands out. We read; we never write, change or delete. And we keep no customer data: a finding holds a count, the column names, and one sample row blanked past its first two characters.
- My app needs some tables to be public. Will you shout at me about those?
- No, and that is the whole point of the second example above. We look at what is in a table before deciding what to call it. A product list everyone is meant to see is reported calmly; a table with people in it is not. Crying wolf on a recipes table is how a tool teaches you to ignore it.
- What if you cannot find my database at all?
- Then the report says so, in those words. Some apps keep their data somewhere we cannot reach from outside, and a check that could not run is never shown as a pass. An all-clear you did not earn is the most expensive thing a scanner can hand you.