Beat the FINAL BOSS Before Launch
Security scans for apps built with Cursor, Lovable, Bolt, v0, and Replit. Find vulnerabilities before attackers do.
Vibe-coded apps ship fast—but so do vulnerabilities
AI-assisted development is incredible, but security gaps slip through. Real incidents show what can go wrong.
Lovable RLS Bypass (CVE-2025-48757)
Misconfigured Supabase Row Level Security policies in Lovable-generated apps allowed unauthenticated attackers to read and modify user data. A scan found 303 vulnerable endpoints across 170 projects.
Read CVE disclosureExposed service_role Keys
Supabase service_role keys leaked in client JavaScript bundles bypass all Row Level Security, giving attackers full database read/write access.
Supabase key security docsThese aren't edge cases—they're common patterns in AI-generated code. A 5-minute scan can save months of cleanup.
How It Works
Three stages to secure your vibe-coded app
Passive Scan
Paste your URL. We check headers, exposed secrets, and common misconfigurations using only normal browser requests.
Deep Analysis
Connect your repo. We scan for hardcoded secrets, auth issues, and test if users can access each other's data.
Fix & Verify
Get fix prompts for Cursor/Lovable, or let our agent open a PR. Re-scan to confirm the boss is defeated.
What the Free Scan Checks
Passive-only checks that won't affect your site
HTTPS & TLS
Verify secure connections and proper redirects
Security Headers
CSP, HSTS, X-Frame-Options, and more
Exposed Secrets
API keys, JWTs, and credentials in HTML/JS
Sensitive Files
.env, .git/config, and other exposed paths
Source Maps
Check if your source code is exposed
SEO & Meta
Title, description, OG tags, robots.txt
Choose Your Difficulty
From quick scans to full boss elimination
Free Scan
Quick passive check
- Security grade & health score
- Top 3 issues preview
- HTTPS & header checks
- Instant results
Launch Check
Full report with fix prompts
- All issues with full details
- Fix prompts for Cursor/Lovable/Bolt/v0
- Downloadable HTML report
- Deeper passive checks
Fixed For You
We fix it for you
- Everything in Launch Check
- AI opens fix PRs
- Before/after scan
- Priority support
Watch
Continuous monitoring
- Weekly automated scans
- Email/Slack alerts
- Trend dashboard
- New vulnerability alerts
Not useful? Email-free refund via the report form within 7 days.
Frequently Asked Questions
The free scan performs passive, non-intrusive checks using only normal GET requests that any browser would make. We check HTTPS/TLS configuration, security headers (CSP, HSTS, X-Frame-Options, etc.), exposed secrets in HTML and JavaScript, publicly accessible sensitive files (.env, .git), source maps, and basic SEO metadata.
Yes, completely safe. We only run passive checks—no fuzzing, no login attempts, no data modifications. We make the same requests a regular visitor would make when loading your homepage and a few standard paths. Your server will see normal GET traffic.
Launch Check includes repo scanning (with your permission), logged-in testing where our agent creates two test accounts to verify one user can't access another's data, builder-specific fix prompts for Cursor/Lovable/Bolt, and a comprehensive security report. This requires proving you own the app.
For deeper scans, you'll either add a verification file to your site, verify DNS ownership, or connect your repository. We never scan apps without owner permission.
Launch Check gives you a detailed report with fix prompts you can paste into Cursor or Lovable. Fixed For You goes further—our AI agent opens a PR with the actual fixes, and we re-scan to confirm they worked. Ideal if you want hands-off resolution.
We're optimized for apps built with vibe-coding tools: Cursor, Lovable, Bolt, v0, Replit, and similar AI-assisted builders. We also work great with standard Next.js, React, and other modern web apps.
Use the report form below to submit details. We take feedback seriously and continuously improve our detection accuracy.
Report an Issue
Found a problem with the scan or have security feedback? Let us know.
Don't Let Your App Get Game Over'd
Run a free scan now, or join the waitlist for Launch Check.