[MORSALIN]
Free toolPassive · no login · no data access

Is your AI-built app leaking?

Apps built with Lovable, Bolt, Cursor and similar tools often ship secret keys in their JavaScript or leave files public. Enter your app’s address and this check looks at it the way any visitor’s browser can, and tells you what a stranger could find.

It reads your public page, its own JavaScript, and whether /.env, /.git and source maps are public. It never logs in, never reads your database, and never shows a secret’s value. Results aren’t stored.

What it checks
Secret keys in your JavaScript
Stripe, OpenAI, Anthropic, AWS, GitHub and SendGrid keys, private keys, and Supabase service_role or secret keys that should never reach a browser.
Supabase and Firebase setup
Whether the app uses them, so you know your data depends on row-level security or security rules.
Public source maps
Whether anyone can download your original source code.
Public .env and .git
Whether your environment file or code history can be downloaded.
HTTPS and security headers
HTTPS, HSTS, Content-Security-Policy, clickjacking protection, nosniff and Referrer-Policy.

A clean result isn’t a clean bill of health: this check can’t see your database rules, server functions, storage buckets or payment webhooks. The AI-Built App Rescue audit tests those from the outside with test accounts, with your written permission, and fixes what it finds. More on this for founders: AI-built apps.