securick Free scan

Free · about a minute · nothing to install

Is your AI-built app safe to launch?

Paste your app's address. We check it the way an attacker would, show you proof of every problem, and give you a fix to paste into Lovable, Bolt or Cursor.

The free scan runs seven security checks on public pages. Nothing is written to your site. No sign-up.

  • Lovable
  • Bolt
  • Cursor
  • Supabase
  • Firebase
See how it works

02 / 07How it works

Three steps. No code, no setup.

  1. Paste your app's address

    Your published link from Lovable, Bolt, Cursor or anywhere else. No sign-up, no SDK.

  2. See what's wrong, in plain words

    A clear verdict first, then each problem with what it means and proof of what we saw.

  3. Paste the fix into your builder

    Every problem comes with a prompt for your AI builder. Scan again to confirm it's fixed.

Next: what we check

03 / 07What we check

Twenty-three checks, in three groups

Start free. Pro adds eight more from the same URL. Deep checks on your database come later, for sites you verify.

Free

Seven checks

Security problems anyone could find on your live site.

  • Leaked keysSecret API keys in your public code
  • Exposed filesDownloadable .env, backups and debug pages
  • Locked origin (CORS)Other sites reading your API
  • Safe errorsError pages that reveal your code
  • Open redirectsLinks that forward visitors to scam sites
  • HTTPS and headersCertificate, HSTS and browser protections
  • Malware and spamHidden spam links, injected scripts, miners, card skimmers, cloaking
  • Blocklist statusWhether Google lists your site as unsafe

Pro adds

Eight more

The launch, legal and compliance side, from the URL alone.

  • Sign-up and email safetyEmail confirmation, login redirects, spoofing
  • Outdated librariesVersions with known vulnerabilities
  • Subdomain takeoverOld DNS records anyone could claim
  • Speed and cachingSlow first loads and heavy bundles
  • Launch readinessTitle, link previews, search settings, monitoring
  • Legal pagesPrivacy, terms, refunds, contact, cookie consent
  • Privacy policy detailsWhat GDPR asks your policy to say
  • Rules for your businessSubscriptions, shops, downloads, affiliate links

Deep

Coming later

Real (harmless) tests on your database and signed-in users, for sites you verify.

  • Data isolationCan strangers read your database?
  • User isolationCan one user see another's data?
  • Privilege escalationCan users make themselves admin?
  • Rate limitsCan bots hammer your login?
  • InjectionXSS, SQL and template injection
  • Edge Function authFunctions anyone can call
  • Database indexesRow-security columns without an index
  • Reset linksDo password reset links expire?

04 / 07The report

Every problem comes with proof and a fix

An example with made-up data, not a real customer's scan.

Fix these first3 to fix

  • Your Stripe secret key is visible to anyone

    Found in your site's code

    Critical

  • Other websites can read your app's data

    Your server trusts any website that asks

    Medium

  • No protection against injected scripts

    A security setting your host can add is missing

    Medium
One problem, opened Critical

Your Stripe secret key is visible to anyone

Anyone who opens your site can copy this key and use your Stripe account: give refunds, create charges or download your customer list.

Proof: what we saw
1. We opened your site's code file, like any visitor's browser does:
GET your-app.lovable.app/assets/index-4f2a.js
2. Inside it, your live secret key (we hide most of it):
Stripe("sk_live_51N••••••••••Qx2")
How to fix it: copy this into your AI builder

Move the Stripe secret key out of the front end. Create a Supabase Edge Function that reads STRIPE_SECRET_KEY from environment secrets and creates the payment there. Call that function from the client instead of using the key. Then roll the exposed key in the Stripe dashboard, because it is already public.

05 / 07Pricing

Free to start. $5 when you want everything.

One payment, not a subscription.

Free

$0

  • Seven security checks, including malware and spam in your pages
  • Every finding with its proof and a fix prompt
  • 3 free scans a day, no sign-up
Run free scan

Pro pass

30 days

$5 one time

  • All fifteen URL checks: free plus legal, GDPR, business rules, libraries, speed and launch readiness
  • 30 scans to use within 30 days. Unused scans don't carry over.
  • A dashboard of every site you tested in the last 30 days
  • PDF report for every scan
Get Pro

Chrome extension: scan the site you're on, right after you hit Publish. It only sends us the address you choose to scan; it never reads your pages or your history.

Coming soon

06 / 07FAQ

Before you paste your URL

Something else on your mind? Contact us.

Yes. It only reads what any visitor can load: your HTML, JavaScript bundles and source maps, plus your home page once more the way Google sees it. Nothing is written and nothing is brute-forced.

07 / 07Ready when you are

Launch day is a bad day to find out

Get your free result in about a minute. Scan right here.