Get the green light before you launch.

A 2-minute security check for apps built with Lovable, Cursor, Bolt and Replit. Finds leaked API keys, Supabase tables anyone can read, open Firebase rules, exposed .env files and API routes without login — with a copy-paste fix prompt for your AI tool.

What we check

Leaked secrets

OpenAI, Anthropic, Stripe, AWS, GitHub, Resend keys and Supabase service_role keys in your JavaScript bundles — and in your git history (Launch Audit).

Database exposure

Supabase tables readable with the public anon key (RLS off or too broad), listable storage buckets, open Firebase Realtime DB / Firestore / Storage rules.

Exposed files & routes

.env, .git, API routes returning user data without login, CORS that lets any site read your API.

Hardening

HTTPS, HSTS, CSP, clickjacking protection and other security headers.

Pricing

Free preview
$0

Issue counts by severity + your top finding in full. Passive checks only.

Full Scan
$19 one-time, excl. VAT

All deep checks after ownership verification, every finding with fix prompts for Cursor / Lovable / Bolt / Replit, unlimited re-scans for 30 days, Greenlit badge.

Launch Audit
$179 one-time, excl. VAT

Everything in Full Scan + GitHub repo scan including full git history + automated AI review of auth, RLS policies and payment logic. Every finding independently re-verified; unverifiable ones are dropped.

All prices in USD excl. VAT. Applicable VAT is calculated at checkout based on your location.

FAQ

Is this legal to run on my site?

Yes, on sites you own or are authorized to test. The free preview only reads what any browser downloads. Deeper checks (database access, exposed files, API auth) run only after you prove ownership with a DNS TXT record, meta tag or file.

Do you download my data?

No. For Supabase we ask the database for a row count only (HEAD request), never the rows. Secrets are redacted in reports and never stored in full.

Which tools do you support?

Apps built with Lovable, Cursor, Bolt, Replit, v0, Windsurf or Claude Code, typically on Supabase, Firebase, Next.js, Vite or React. Every finding comes with a fix prompt you can paste into your tool.

What does Greenlit mean?

A verified full scan found no critical, high or medium issues. You get an embeddable badge with the scan date. It is not a guarantee your app is secure.

Is there a human reviewing my report?

No. Greenlight Scan is fully automated. The Launch Audit adds an AI code review, and every finding is re-checked by a second automated pass — anything we can't verify is dropped.