Free scanner

Which builder did you ship with?

Every AI builder breaks in its own way. Pick yours for a scan tuned to the risks it ships most — or just scan any URL from the home page.

Lovable

The Supabase database Lovable ships with is open until you turn on RLS.

Bolt can bake a server API key straight into your public bundle.

A NEXT_PUBLIC_ env var or a stray source map leaks more than you think.

AI-written auth often trusts the client. We test what's actually readable.

App, secrets, and database in one place — one misconfig exposes all three.