Is your AI-built app ready to go live? Find out free.
Built with Lovable, Bolt, Replit or v0? We check what the builder doesn't tell you: secret keys anyone can copy, customer data anyone can read, the builder's name still on your app, and how it loads on a phone.
Takes 3–10 minutes. No sign-in, no access to your accounts, nothing to install.
- ✕OpenAI key in the app's codeAnyone can copy it and run up your bill
- ✕“profiles” table readable without signing inCustomers' emails and phone numbers, open to anyone
- ✕Shared links show “Lovable App”Your brand is missing on WhatsApp, LinkedIn and Google
- ✕Runs on the builder's addressLooks temporary, and the ranking isn't yours
- ✓Secure connection (HTTPS)Fine as it is
It works in the preview. That's not the same as ready.
AI builders get you to a working app in days. What they don't do is check it the way an experienced developer would before real customers arrive.
A key pasted into a prompt ends up in code anyone can read. A Supabase table is left open, so every sign-up's email and phone number can be downloaded. Links shared on WhatsApp still say “Lovable App”. Google sees a blank page.
None of it shows while you click around your own app. This check finds it in minutes, and tells you what to fix first.
What we check in your app
Every check runs on the parts of your app any visitor's browser downloads. We never sign in, never change anything and never download your data.
Secret keys in your codeCan anyone copy your OpenAI or Stripe key?
We read your app's JavaScript for secret keys that should only live on a server: OpenAI, Claude, Gemini, Stripe, Supabase service keys, AWS, GitHub and more. We show only the first few characters, never the whole key.
Customer data anyone can readIs Row Level Security switched on?
Using your app's public Supabase key, as any visitor could, we count the rows each table lets anyone read without signing in. We also check whether your Firebase database is open. We count, we never download.
Private files left onlineIs your .env file downloadable?
Configuration files with passwords and keys, your source code history, and source maps that publish your code as you wrote it.
Your brand, not the builder'sDoes it still say “Lovable App”?
The builder's default title, description, sharing image and icon, and whether the app runs on the builder's web address instead of your own domain.
Speed on a phoneHow long do people stare at a blank screen?
Google's PageSpeed test on mobile and desktop, and how much JavaScript your app makes every visitor download before anything shows.
Found on Google and by AICan search engines and ChatGPT read it?
Whether your content exists without JavaScript, plus titles, sitemap, robots.txt and the rest of our website health check. If you collect sign-ups, whether there's a privacy policy.
Made for apps built with AI
It recognises the common builders and backends, and checks each the right way. Send a regular website and you get our full website health check instead.
Found a problem? Get it fixed this week.
Every problem in the report has a “Get this fixed” button. It opens Reset Tasks with the problem filled in: one fixed price, agreed with you before you pay, done within 3 working days and backed by a money-back guarantee.
Prefer to fix it yourself? Each problem comes with what to change, in plain words you can paste into your builder.
See how Reset Tasks works ↗FAQ
Is it really free?
Yes. You see your grade and top problems straight away; leave your email to unlock the full list. Some people ask us to fix what we find, and there's no obligation.
Do you need access to my app or my Supabase account?
No. We only look at what any visitor's browser already downloads when they open your app: its pages and its JavaScript. We never sign in and never change anything.
Do you read or keep my data?
No. For open tables we ask only how many rows can be read, which returns a number and no data. Keys are never stored: the report shows the kind of key, where it is, and its first few characters.
My app is behind a login. Can you still check it?
Yes. The code for your logged-in screens is downloaded by every visitor, so keys and database settings show up there too. The pages after login aren't read.
How do you know if it's a website or an app?
From how it's built: the builder's fingerprints (Lovable, Bolt, Replit and others), a page that's empty until JavaScript runs, and a backend like Supabase or Firebase with sign-in. An app gets the app checks on top of the website checks.
We found a secret key. What now?
Cancel it with the provider today and create a new one, then move the code that uses it to a server function (in Lovable or Bolt, a Supabase Edge Function). Removing it from the code isn't enough: anyone who copied it can still use it until it's cancelled.
Can I check someone else's app?
You can check any public address, and we only read what's public. Please use it on apps you own or are building, or to warn the owner.
Check your app before your customers do.
Free. No access needed. Your report in about 10 minutes.