of Lovable apps in one scan had weak Supabase Row Level Security (170 of 1,645 projects). User data, payment info and API keys were exposed. It’s now CVE-2025-48757.
Source: Matt Palmer disclosure · CVE-2025-48757For people shipping apps with Lovable, Bolt or Cursor
Your AI-built app might be leaking API keys. Check before you launch.
We look at your live app from the outside, the same way an attacker would. If there's a secret in
your JS bundle, an open Supabase or Firebase table, or a public .env file, you get a
plain-English fix you can paste back into your builder.
Everything is read-only. Database checks only run after you verify you own the app, and we never store your rows.
Free scan
We only look at what any browser can already see. We don’t query your database, and we never use a key we find.
?
More findings
Want the rest? The $49 report lists every finding with a fix prompt for Lovable, Cursor or Bolt, and adds the Supabase and Firebase checks once you verify ownership.
The $49 report isn’t open yet. Leave your email and we’ll send you one email when it opens.
We’ll save your email and the app URL you scanned. No spam. Privacy Notice.
Get the full $49 reportUsing Supabase? Here’s the checklist we’d run before launch.
This keeps happening to real apps
These are documented incidents from the last couple of years, and they’re the same mistakes we scan for.
agent API tokens leaked when Moltbook shipped a Supabase key with RLS turned off. Tens of thousands of emails and private messages leaked with them (January to February 2026).
Source: Wiz Research · ReutersAPI balance drained overnight because a key was left in frontend code. This one happens a lot. Enrichlead, a SaaS built with Cursor, shut down after its founder posted “guys, I’m under attack.”
Source: r/vibecoding · Enrichlead write-upHow it works
You don’t need to be a security engineer to use this.
1
Scan your live URL
We check your headers and TLS, search your public JS for provider secrets, and look for exposed files like .env, .git and backups. Once you prove you own the app, we also test Supabase RLS and Firebase rules.
2
Get plain-English fixes
Each finding tells you what someone could actually do with it. They’re sorted by how much money or data is at risk, and each one comes with a prompt you can paste into Lovable, Cursor or Bolt.
3
Re-scan until you’re green
Fix things and run the free scan again. When a Launch Report finds no critical or high issues, it includes a dated launch-ready certificate for that URL.
Pricing
The Launch Report is a one-time payment through Stripe. If the scan fails or we can’t deliver your report, we’ll fix it or refund you. Keep in mind these are automated checks, not a security guarantee.
Free scan
$0
- Outside scan of your live URL
- Headers, TLS, exposed files
- Leaked-key patterns in JS
- A grade and your top issue
START HERE
Launch Report
$49 one-time
- Every finding, ranked (web report and email)
- Copy-paste fix prompt per finding
- Owner-verified Supabase RLS / Firebase rules checks
- Launch-ready certificate if no critical or high issues
COMING SOON
Fix-It-For-Me
$149 one-time
- Everything in Launch Report
- An agent opens a pull request or policy change with the fixes
- Re-scan to prove it worked
- Requires your GitHub or Supabase access
COMING SOON
Watch
$19 /mo
- Weekly re-scan of up to 1 URL
- Email only when something gets worse
- Cancel anytime
FAQ
Do you only scan apps I own?
For the deep checks, yes. The free scan only reads public headers and JS, like any browser does. Before we test Supabase RLS or Firebase rules, you verify ownership with a <meta name="lockdownlaunch-verify"> tag (your AI builder can add it), a DNS TXT record lockdownlaunch-verify=…, or a file at /.well-known/lockdownlaunch.txt, and you confirm you’re allowed to test the app. If nobody has verified an app, we don’t run deep checks on it.
Do you store my data or use my API keys?
No. We never call a provider with a key we find, and reports only show a masked fingerprint of each secret. Database checks ask for at most one row so we can read the count header, then throw the response away. We don’t store row contents. Paid reports are deleted after 30 days. Details are in our Privacy Notice.
What does the free scan check?
HTTPS and redirects, security headers, CORS and cookie flags. We also look for secret patterns in your public HTML and same-origin JavaScript (masked, never used or tested), check whether /.env, /.git/config or source maps are public (we only check that they exist), and note whether you use Supabase or Firebase. Database and rules testing only happens in the paid report, after you verify ownership.
What stacks do you support?
Any live web app. It’s tuned for Lovable, Bolt, v0, Cursor, Replit, Supabase and Firebase, since that’s where vibe-coded apps usually leak. Mobile apps aren’t supported.
Is a good grade a security guarantee?
No. We catch common, high-impact mistakes. Apps handling payments, health, or regulated data still need a professional review. The launch-ready certificate only means “no critical or high issues found by our automated checks at scan time on this URL.”
What if something goes wrong with my $49 report?
If the scan fails or we can’t deliver your report, email [email protected] within 14 days and we’ll fix it or refund you in full. Other requests are handled case by case. See our Terms.
Are Fix-It-For-Me and Watch available?
Not yet. They’re coming soon. Join the list below and we’ll email you once when they open.
Get an email when paid reports open
The $49 Launch Report opens first. Fix-It-For-Me and Watch come after that. Join the list and we’ll email you when they open. No card required.