FixedLaunchBack

free scan

Scan your AI-built app

Paste your app's link. You get a score and every issue the scan finds, worst first. The worst one comes with its fix, free.

Lovable, Bolt, v0, Replit, Cursor, Claude Code · any public link

Free · no sign-upNo app handy?

FixedLaunch

Scanning

Checking

We read public pages and files and try a few anonymous reads. Nothing on your app changes.

  1. Security headers

    CSP, HSTS, framing and sniffing rules

    Waiting

  2. Cookies

    Secure and HttpOnly flags on the cookies it sets

    Waiting

  3. Keys in your code

    Stripe, OpenAI, Supabase and database keys in the page

    Waiting

  4. Public files

    .env, .git, source maps and server code

    Waiting

  5. SEO and previews

    Title, description, share image, sitemap

    Waiting

  6. Page health

    Error pages, broken links and files, mixed content

    Waiting

  7. Stripe webhooks

    Signing secrets and public webhook routes

    Waiting

  8. Database access

    Anonymous reads on Supabase or Firebase

    Waiting

  9. Private API data

    Anonymous reads of the APIs the page calls

    Waiting

Database and API results are clues, not proof. Browser errors, load speed and rate limits aren't checked here.

What it checks

Reads public pages, scripts, headers and files, then makes a few anonymous reads of discovered APIs and databases. It may use a public Supabase anon key paired with its project. It never logs in, submits forms, changes data or uses server secrets.

  • Keys in your JavaScriptStripe, OpenAI, Anthropic, Supabase service_role and other secret keys shipped to the browser
  • Anonymous access cluesdiscovered Supabase and Firebase reads, potentially private API responses, and Stripe webhook review clues; public access can be intentional
  • Files that shouldn't be public.env files, .git folders, source maps
  • Security headers and cookiesCSP, HSTS, framing, cookie flags
  • Leftovers from the buildlocalhost URLs, dev-mode bundles, mixed content, broken assets
  • Search and sharing basicstitle, description, share image, robots.txt, sitemap, 404 pages
  • Heavy first loadhow much JavaScript the first page pulls in

After the scan

  • $9 unlocks every fix as a prompt you can paste into your builder, plus a re-scan to check each fix held. See a sample unlocked reportOne-time card payment, no subscription. Unlocks on this link right away. Full refund within 7 days. Paid through Dodo Payments. Terms · Refunds

4 areas that still need an inside review

The scan can flag some public access and webhook clues. These areas still need server code or test accounts.

  • Database rulesfull row policies, writes and access between accounts
  • Authsign-up, sessions, password resets and access between roles
  • Paymentsserver prices and webhook signature validation
  • Background jobsemails, cron jobs, queues

Want a person to look inside? See the diagnosis