Your AI built it.
We make sure it survives real users.
Paste your GitHub repo. In a few minutes you get a launch-readiness grade covering leaked keys, open databases, broken payments and runaway AI bills, with copy-paste fixes for your AI tool.
Free · public repos · no signup · results in ~2–5 min
// the problem
Shipping is easy now. Shipping safely is not.
of 1,645 Lovable showcase apps leaked user data through missing Supabase row-level security (CVE-2025-48757).
source: Matt Palmer ↗high-impact vulnerabilities found across 5,600+ vibe-coded apps in production.
source: Escape.tech ↗of AI code-generation tasks introduced a known OWASP Top 10 vulnerability.
source: Veracode 2026 ↗// what we check
Five areas where AI-built apps break
Leaked secrets
API keys in client bundles, committed .env files, service-role keys, and secrets in VITE_/NEXT_PUBLIC_ vars.
Open database
Supabase tables without RLS, “allow all” policies, and anon write access to sensitive tables.
Payments
Stripe webhooks without signature checks, client-trusted prices, and secret keys in the browser.
AI cost bombs
Unauthenticated AI routes, no rate limits, and LLM SDKs called from the browser with your key.
Deps & deploy
Known-vulnerable packages (OSV), type errors, broken builds, and risky deploy config.
Powered by semgrep, gitleaks, OSV-Scanner and 30+ custom rules for Supabase, Stripe and AI SDKs, plus an AI pass that filters false positives (paid tiers).
// sample report
Plain English. Exact files. Fix prompts included.
Summary: Not launch-ready. Any visitor can read and modify the profiles table, and your OpenAI route has no auth or rate limit. Fix the two items below first (about 30 minutes with the prompts provided).
supabase/migrations/2025_init.sql:42
Replace the policy “Allow all” on public.profiles with one restricted to auth.uid() = id for update/delete…
src/routes/api/chat.ts:8
Add a session check at the top of the chat handler and return 401 when there's no user; add a per-user rate limit of…
// pricing
One-time. No subscription.
Quick Check
See where you stand.
- ✓Launch grade A–F
- ✓Issue counts by severity
- ✓Top 2 findings previewed
- ✓Public repos
Rescue Report
Everything you need to fix it yourself.
- ✓Every finding with file:line
- ✓AI-reviewed: likely false positives filtered
- ✓Plain-English summary + top 3 actions
- ✓Copy-paste fix prompt per issue
- ✓Downloadable HTML report
Report + Fix PRs
Coming soon: we open the pull requests.
- ✓Everything in Rescue Report
- ✓PRs for critical & high issues
- ✓Private repos via GitHub App
// faq
Questions
Do you store my code?+
Free scans clone the public repo into a temporary folder, run the scanners, and delete the clone. We keep the findings, not your source.
Which stacks do you support?+
Anything on GitHub, tuned for what AI builders generate: React/Vite, Next.js, TanStack Start, Supabase, Stripe, and the OpenAI/Anthropic/xAI SDKs. Lovable, Bolt, v0, Cursor and Replit exports all work.
Private repos?+
The free Quick Check covers public repos. Paid scans will support private repos through a read-only GitHub App (coming soon).
What's in the $29 Rescue Report?+
Your launch grade plus every finding from the scan: file and line, severity, plain-English impact, and a copy-paste fix prompt for Lovable/Cursor for each issue. An AI reviewer double-checks each high-impact finding against your code, filters likely false positives, and writes a plain-English summary with your top 3 actions. View it online or download it as a standalone HTML file. It's all automated, not a manual audit.
What about Fix PRs?+
Coming soon. The $49 tier will open pull requests for the critical and high issues we can patch safely. It isn't for sale yet; join the newsletter to hear when it is.
Is this a full security audit?+
No. It's automated static analysis aimed at the mistakes AI tools make most often. It catches a lot, but a clean grade doesn't guarantee your app is secure.