Skip to content
Get a quote

Free toolAI app security check

Paste your live app’s address. In a few seconds you see whether secret keys ship in its JavaScript, which Supabase or Firebase project it uses, and which security headers are missing. Made for apps built with Lovable, Bolt, Cursor, Replit, v0 or Firebase Studio.

Check my app

Free, no sign-up. It reads only what any visitor’s browser downloads.

Check your app

What it checks: secret keys shipped in your JavaScript (shown masked), which Supabase or Firebase project the app uses and the tables its code names, security headers, and the page tags search engines and link previews read.

What it doesn’t: anything behind a login, your data rules, payments, or whether your tables can be read. Those need the free table check (after you prove you own the site) and the $450 Launch Check.

What it looks for

Secret keys in your JavaScript
Supabase service_role and secret keys, Stripe secret and webhook keys, OpenAI, Anthropic, GitHub, SendGrid and AWS keys, and private keys. Each is shown masked (at most the first 6 and last 4 characters) and only counts when it looks like a real key, not a placeholder.
Your Supabase or Firebase project
Which project the app talks to and the tables its code names. Public keys, like the Supabase anon key and the Firebase web key, aren’t flagged, because they are meant to be public.
Security headers
Content-Security-Policy, protection against framing, Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy.
What search and link previews read
A noindex tag, a missing title, meta description or share image, and source maps that can publish your original code.

A sample report

This is the check’s own output for a made-up app whose code ships a Supabase service_role key. Your report has the same parts: rated findings, what passed, and what it noticed but didn’t rate.

Sample report, made-up app. Report for your-app.example: the home page and 1 script read, 2.1 MB

1 critical, 2 low, 3 passed

  1. CriticalA Supabase service_role key is in your public JavaScript

    Anyone who opens your site can copy it. It skips row-level security, so it can read, change or delete every row in every table.

    Found: eyJhbG…X9Qk in /assets/index-4f2a.js (role: service_role)

    Fix: Rotate the key in Supabase (Project Settings, API Keys), then move the calls that need it into an Edge Function. The browser should only ever have the anon or publishable key.

  2. LowNo Content-Security-Policy header

    Nothing limits which scripts the page may run, so an injected script would run freely.

    Fix: Add a Content-Security-Policy header in your host’s settings, starting with your own domain and the services you use.

  3. LowThe page can be framed by any site

    No X-Frame-Options or frame-ancestors rule, so another site can embed your pages and trick visitors into clicking on them.

    Fix: Add frame-ancestors 'self' to the Content-Security-Policy, or X-Frame-Options: DENY.

  4. InfoSupabase project found, with 3 tables named in your code

    Project abcdefghijklmnopqrst. Your code reads 3 tables: invoices, notes and profiles. Whether a logged-out visitor can read them depends on your row-level security, which this check doesn’t test.

    Test which of your tables are readable (free, after you prove you own the site)

Passed

  • ✓ No Stripe secret key in the files read
  • ✓ HTTPS with Strict-Transport-Security
  • ✓ X-Content-Type-Options and Referrer-Policy set

Also noticed, not rated

  • The home page has a noindex tag, so search engines won’t list it.
  • No meta description or share image (og:image), so links to the site show a bare preview.

How it stays passive

  • It sends only GET requests, like a browser: your home page and up to 12 of its own scripts.
  • It reads https pages only, on your site only. It never contacts Supabase, Firebase or any other service.
  • It never logs in, never queries your database and never writes anything.
  • Nothing it reads is stored or logged. Keys appear in your report masked, never in full. The only thing kept is a count per site, under a hash of the address, to cap checks.
  • It reads at most 2 MB of the page, 3 MB per script, 12 scripts and 10 MB in all, within 9 seconds, and says so when it stopped early or a script came back in a form it can’t read.
  • You can run 5 checks a minute, and each site can be checked 10 times an hour.

What this check can’t see

Anything behind a login, your database rules, your Stripe webhooks and your deploys. Finding no key doesn’t prove your data is safe: a public key with weak rules can still expose it. Next steps, all free: the Supabase table check tests which tables a logged-out visitor can read after you prove you own the site, the Supabase RLS policy checker reads your policy SQL, and the Firebase rules checker reads your Firestore rules.

Questions

Is it safe to check my app here?
Yes. It reads the same files any visitor’s browser downloads, with GET requests only, and stores none of what it reads. It keeps only a count per site, under a hash of the address, to cap checks at 10 an hour. Anyone can already read these files, which is why a secret key in them is a problem.
Is it a problem that my Supabase anon key is in my JavaScript?
No. The anon or publishable key is meant to be public. What matters is your row-level security, which decides what that key can read. The free Supabase table check tests that after you prove you own the site.
It found a secret key. What do I do first?
Treat it as leaked: roll it in the service’s dashboard first, then move the code that uses it to a server or edge function. Removing it from the code alone isn’t enough, because copies may already exist.
Does a clean report mean my app is secure?
No. It means no secret key was found in the files read and your headers are set. Data rules, sign-in, payments and anything behind a login need a deeper look, which the Launch Check covers.

Want the whole app checked?

The Launch Check covers what this tool can’t see: sign-in, your Supabase or Firebase data rules, Stripe and deploys, ranked by severity with evidence, in 3 business days from read-only access. Fixing what it finds is optional and quoted in the report.

Pay $450 for a Launch Check

Full refund if Simon can’t take it on once he sees your project, or if you cancel before work starts.

No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

How the AI-Built App Rescue works

Link to this checker

Writing about vibe-coded apps, Lovable or Bolt security, or a launch checklist? You’re welcome to link here. The check is free and needs no sign-up.