FixedLaunchBack

sample report

fl-budget-demo.vercel.app

Sample report. This is what the $9 unlock shows: every fix as a prompt for your builder.

11 issues found. All 11 fixes unlocked.

Our test app, built with AI and broken on purpose · scanned 19 Oct 2026

Scan my app free

Fix Kit

Pick your builder, then paste a prompt into it. Each fix below has its own. For all 11 at once, paste round 1, check the app still works, then paste the next round.

  1. criticalDatabase or data file is publicly downloadable

    • /data.json is public (keys: users, sessions, budgets)

    fix

    Move data files outside the static folder and block them at the server.

  2. highServer source code is publicly downloadable

    • /server.js is public

    fix

    Serve only the public/static folder (for example express.static("public")), never the project root.

  3. mediumNo Content-Security-Policy header

    • no Content-Security-Policy header on the page

    fix

    Add a Content-Security-Policy header (next.config headers(), vercel.json headers, or helmet for Express).

  4. lowNo X-Content-Type-Options header

    • X-Content-Type-Options: nosniff not set

    fix

    Send X-Content-Type-Options: nosniff.

  5. lowPage can be framed by any site (clickjacking)

    • no X-Frame-Options and no CSP frame-ancestors

    fix

    Send X-Frame-Options: DENY or a CSP with frame-ancestors 'none'.

  6. lowNo Referrer-Policy header

    • no Referrer-Policy header

    fix

    Send Referrer-Policy: strict-origin-when-cross-origin.

  7. lowNo meta description

    • no <meta name="description">

    fix

    Add <meta name="description"> with one sentence about the app.

  8. lowNo Open Graph tags (links share without a preview)

    • no og:title or og:image meta tags

    fix

    Add og:title, og:description and og:image.

  9. lowNo robots.txt

    • /robots.txt → 404

    fix

    Serve /robots.txt (Next app/robots.ts, or a static file in public/).

  10. lowNo sitemap.xml

    • /sitemap.xml → 404

    fix

    Serve /sitemap.xml (Next app/sitemap.ts, or a static file in public/).

  11. lowFavicon missing or still the template default

    • no <link rel="icon"> and /favicon.ico is missing

    fix

    Replace the default favicon (vite.svg and similar) with your own icon.

4 areas that still need an inside review

The scan can flag some public access and webhook clues. These areas still need server code or test accounts.

  • Database rulesfull row policies, writes and access between accounts
  • Authsign-up, sessions, password resets and access between roles
  • Paymentsserver prices and webhook signature validation
  • Background jobsemails, cron jobs, queues

Want a person to look inside? See the diagnosis

Passive scan: it loaded what any visitor's browser gets (pages, scripts, headers and a few well-known files). It didn't log in, fill in forms or use any key it found.