Launch security check for AI-built apps

Ship your AI-built app without leaking keys.

Paste a URL. We look at your app the way an outsider would and explain each issue in plain English, with a prompt your AI tool can use to fix it.

First scan is free, no signup and no code access. By scanning you confirm you own this site or are authorized to test it, and agree to the Terms and Privacy Policy.

acme-launch.app · scan report
D

One key needs rotating before launch.

Built with Lovable · Supabase · Vercel

Issues
5
Hardening
7
Checks
108
  1. CriticalSupabase service key is readable in main.jsJS bundle
  2. HighSource map publishes your src/ folderSource maps
  3. MediumAnyone can send email as your domainDMARC
  4. MediumSession cookie set without SecureCookies
  5. LowNo Content-Security-Policy headerHeaders

Passive external check; application logic (SQLi, IDOR) is not tested.

checks across headers, TLS, DNS, email and supply chain
100+
secret patterns searched in your JavaScript and source maps
~40
for the first scan, no signup and no code access
$0