about
About FixedLaunch
Last updated . Questions: hello@fixedlaunch.com
FixedLaunch makes the FixedLaunch Scan. Paste the link of an app built with Lovable, Bolt, v0, Replit, Cursor or a similar tool, and it checks what any visitor's browser can see: secret keys in the JavaScript, files that should be private, missing security headers and more. You get a score in seconds, for free.
At a glance
- Scan
- Free. Paste your app's link and get a score in seconds.
- Full report
- $9 one-time: every fix as a prompt for your builder, plus a re-scan. No subscription, no account.
- Refunds
- A full refund within 7 days: email hello@fixedlaunch.com with your report link.
- Replies
- Within 24 hours, in writing, by email or X DM.
- Safety
- Read-only: public pages and a few discovered API/database reads, using only paired public anon keys. No logins, forms, writes or server secrets.
- Builders
- Web apps built with Lovable, Bolt, v0, Replit, Cursor, Base44, Emergent, Firebase Studio, Google AI Studio, Windsurf, Claude Code and Same.
Who runs it
FixedLaunch is one person: me, Harjot. I'm a full-stack developer on Next.js and Supabase, and I built the FixedLaunch Scan. I'm in New Delhi, India and work US Eastern hours. My personal site is https://harjotrana.com. FixedLaunch isn't a registered company: Harjot Singh Rana runs it as an individual.
What I've built
Helicon (https://github.com/HarjjotSinghh/helicon), my open-source desktop app for Muse Code (unofficial).
What the scan does
The scan reads public pages, scripts, headers and files, then makes a few anonymous reads of discovered APIs and databases. It can flag public access and Stripe webhook review clues, with limits stated in the report. The score and the list of issues are free. For $9, one-time, the full report unlocks every fix as a prompt you can paste into the tool that built your app, plus a re-scan to check each fix held. $9 is charged once by card through Dodo Payments, the merchant of record, with no subscription and no account.
What it can't see
Full database policies, access between accounts, sign-in flows, payment logic and background jobs need server code or test accounts. A clean score does not prove those areas are safe.
Apps it works on
Web apps built with Lovable, Bolt, v0, Replit, Cursor, Base44, Emergent, Firebase Studio, Google AI Studio, Windsurf, Claude Code and Same. Only scan an app you own or have the owner's permission to scan.
Fix guides
Free step-by-step checks you can run on your own app. See all fix guides