Paste your app's URL. Get a plain-English launch report covering leaked keys, missing security headers, Google and share previews, mobile, speed, accessibility and broken links. Every issue comes with a fix prompt you paste straight into your AI tool.
Run a free mini-scan Full report, $29Made for apps built with Lovable · Bolt · v0 · Cursor · Replit · Windsurf
Six areas that decide whether a launch goes well. All checks are passive: we only load public pages, the way a visitor's browser does.
API keys and secrets exposed in your JavaScript (masked in the report), Supabase and Firebase config warning signs, exposed .env, .git and source-map files, HTTPS/TLS, and security headers like CSP and HSTS.
Title, description, canonical, robots.txt, sitemap.xml, plus Open Graph and Twitter tags so your links look good when shared.
Real phone-size screenshot, viewport setup, tap targets and text that's too small to read.
Lighthouse performance on mobile: load time, layout shift, oversized images and heavy scripts.
Missing alt text, low contrast, unlabeled buttons and form fields, and other issues that lock people out.
We follow links on your own domain (politely, with a limit) and list every 404 and dead page.
Get your overall grade, how many issues we found, and the single most important fix. We email it to you, usually within a few hours.
Only scan sites you own or have permission to scan. We never log in, never submit forms on your site and never read your database.
One-time payments. No subscription.
No. It's a launch checklist. We run passive checks only: we load your public pages and files like a normal browser, and look for common mistakes. We don't try to break in, guess passwords, fuzz inputs or read your database. A clean report doesn't guarantee your app is secure.
We never use or test it. The report shows it masked (for example sk-…a9F2), it's sent only to you, and we tell you how to move it server-side and rotate it.
Within 24 hours, usually much sooner. If we miss 24 hours, you get a full refund automatically.
Email us within 14 days for a full refund, no questions asked.
We check what's publicly reachable: your landing page, public pages and the JavaScript they load. We don't log in to your app.
Anything with a public URL. The fix prompts are tailored to the tool you tell us you used: Lovable, Bolt, v0, Cursor, Replit or something else.