AppInspected

Find the keys your AI left in the browser.

Paste your app's address. In about 20 seconds you'll see every secret key, open config file and missing protection that any visitor to your site can already see.

Free. No sign-up. We only read what your visitors' browsers already read.

Made for apps built with Lovable, Bolt, v0, Replit, Cursor, Windsurf and Claude Code.

AppInspected
App
Waiting for your address
Checked
–
Critical issues
–
Not checked yet
This is the tag your result fills in. With monitoring, it becomes a live badge on your site.

What the free check looks for

AI coding tools optimize for "it works." These are the mistakes we see them ship most.

Secret keys in your JavaScript
Stripe, OpenAI, Anthropic, AWS, GitHub, SendGrid, Resend and Twilio keys that belong on a server, not in the browser.
Supabase service_role keys
The key that skips every Row Level Security rule. If it's in your frontend, your whole database is public.
Downloadable .env and .git
Config files and source history that were deployed by accident.
Public source maps
Files that let anyone rebuild your readable source code.
Missing security headers
HTTPS enforcement, content security policy, framing and file-type protection.
Keys that are meant to be public
Supabase anon, Firebase and Stripe publishable keys, flagged as fine so you don't panic for nothing.

Show your users you checked

People are getting wary of apps built in a weekend. A live badge tells them someone is watching the doors.

  1. Check

    Run a report on your live app or your code.

  2. Fix

    Every finding comes with the exact steps, or a prompt to paste into your AI tool.

  3. Keep it green

    We re-check every day. Your badge links to a public page with the latest result, and it turns grey if something new breaks.

Pricing

Start free. Pay only when you want the deep check or the badge.

Quick check

$0

Everything on this page's free check: public keys, exposed files, source maps, headers.

Check my app

Live app report

$19 one time

Tests your Supabase Row Level Security and Firebase rules from the outside, plus fix steps for every finding. Requires proof you own the app.

Code report

$49 one time

Read-only GitHub access. Finds secrets in your code and history, API routes without login checks, and unsafe database policies.

Badge and monitoring

$9 per month

Daily re-checks, an alert when something breaks, and the live badge with its public status page.

Questions

Is the free check safe to run on my app?

Yes. It loads your page and its JavaScript the way a browser does, and requests two well-known paths (/.env and /.git/HEAD) to see if they're exposed. It never logs in, never writes data and never uses any key it finds.

Do you store my results?

No. The free check runs, shows you the result and forgets it. We keep only a daily count of how many checks ran. Found keys are always shown cut short, never in full.

Can I check an app I don't own?

The free check only reads public information, the same as visiting the site. The paid reports go further, so they require proof that you own the app before they run.

Does a clean result mean my app is secure?

No. It means none of the problems we check for were visible from the outside. The free check can't see your database rules or server code, so a clean result is a good start, not a guarantee.

I found a leaked key. What now?

Rotate it first: create a new key in that provider's dashboard and delete the old one. Removing it from your code isn't enough, because copies of the old version may still be out there. Then move the call that needs it to your server.

Can an AI agent use this?

Yes. Agents can call GET /api/v1/check?url=<address> and get JSON back. Instructions for agents are in llms.txt.