Free Security Scan
Check your app in a couple of minutes.
Prove it's yours, and we'll run a quick, safe, read-only check for the security and compliance problems that most often catch out AI-built apps.
How it works
- 1
Enter your app
Give us your live app's address and confirm it's yours.
- 2
Prove it's yours
Add a small verification code to your domain. This is how we make sure the tool is only ever used on apps their owners ask us to check.
- 3
Get your report
We run a quick, read-only check and show the results here: what's wrong, why it matters, and how to fix it.
Questions
- Is this safe to run on my app?
- Yes. The check is passive and read-only: it only looks at what your app already shows to any visitor. It never guesses passwords, never tries to break in, and never touches other people's data.
- Why do I have to prove I own the app?
- So the tool can't be used to scan apps that aren't yours. You add a small code to your domain's DNS or a file on your site, and we confirm it before checking anything.
- What does it check?
- Exposed secret keys in the browser, databases readable without login, security headers, HTTPS, a privacy policy, cookie consent, an account-deletion option and accessibility basics. Some things, like the two-account data test and payments, still need a person.
- Can it fix the problems for me?
- The report shows how to fix each issue yourself. If you'd rather a real person do it, one button sends us the details and we reply with a fixed price.
- Does my app need a custom domain?
- Yes. We scan apps on their own domain, not a builder sub-domain like myapp.lovable.app, myapp.vercel.app or myapp.netlify.app, because ownership can only be verified on a domain you control. If your app is still on a builder address, ask for the free Launch Check video instead: a person checks it as a normal user, with no DNS changes needed.