AI App Security Scan
Find exposed keys and open database tables in your Lovable, Bolt or Supabase app before someone else does. $49, plain-English report within 24 hours.
Scan my app: $49 Free mini-check
The problem
AI app builders talk to your database straight from the browser, and the only thing protecting your data is Row Level Security. When it's missing, anyone can read the table. In 2025, a researcher scanned 1,645 apps built with Lovable and found 170 of them (10.3%) leaking data from 303 database endpoints, including names, emails, phone numbers, payment details and API keys. It was rated critical (CVE-2025-48757, CVSS 9.3).
Sources: Matt Palmer, Statement on CVE-2025-48757; NIST NVD. The vendor disputes the CVE, saying each app owner is responsible for their own data, which is exactly why it pays to check yours.
What we check
- Tables anyone can read. We test whether your Supabase tables return data to a visitor who never logged in (missing or loose Row Level Security).
- Secret keys in your website code. Stripe sk_live keys, Supabase service_role or secret keys, OpenAI, Anthropic, AWS, GitHub and other keys hiding in your JavaScript.
- Public storage buckets. Buckets that let anyone download uploaded files.
- Login settings. Open sign-ups with auto-confirmed emails, which make "logged-in only" rules effectively public.
- Edge functions and CORS. Functions any website can call, and APIs that trust any origin.
- Security headers. HSTS, Content-Security-Policy, clickjacking and MIME-sniffing protection.
- Leaked files. Public .env files, .git folders and source maps that reveal your code.
Passive and read-only: we only make the same kinds of requests a visitor's browser makes, never write or delete anything, and never keep your users' data.
Sample report excerpt
Overall: RED (1 critical, 1 medium, 2 low)
[CRITICAL] Table "profiles" is readable by anyone
What we saw: a visitor with no login got data back.
Columns visible: id, email, full_name, phone
Fix (Supabase > SQL Editor):
alter table public.profiles enable row level security;
create policy "own profile" on public.profiles
for select using (auth.uid() = id);
Or paste into Lovable: "Enable RLS on profiles and only
let users read their own row. Don't change anything else."
[MEDIUM] Missing Content-Security-Policy header
Fix: add a CSP in vercel.json (snippet included)Pricing
AI App Security Scan: $49 one-time
A full scan, a severity-ranked report, a copy-paste fix for every issue, and one free re-scan after you fix things.
Buy the scan: $49Security Re-Scan Monthly: $29/month
We rescan every month and alert you when something new appears. Cancel anytime.
Subscribe: $29/moNot ready to pay? Get a free mini-check: we'll look for the single biggest issue and email you. By ordering, you confirm you own the app or are authorized to have it tested. See Terms. This is not a penetration test or a guarantee of security.
FAQ
Is the scan safe for my app?
Yes. It is passive and read-only. We only look at what is already public, the same way a browser does. We never write, change or delete data, create accounts, or try to break in.
What do you need from me?
Your live app URL and confirmation that you own the app or are authorized to have it tested. Optionally, your Supabase project URL and public anon key, which are already in your app. Never send your service_role key or passwords.
Do you look at my users’ data?
No. If a table is readable, we record only that it is readable and its column names, never the contents.
How fast do I get the report?
Within 24 hours, as a plain-English report ranked by severity, with a copy-paste fix for every issue: SQL, a prompt for Lovable or Bolt, or a config snippet.
Is this a guarantee my app is secure?
No. It checks the most common holes in AI-built apps at a point in time. It is not a penetration test or a certification.
Can you fix what you find?
Yes. Use the fixes yourself, or order a Done-For-You Fix ($149) and we will open a GitHub pull request you approve.
What does the monthly re-scan do?
We rerun the scan every month and email you only when something new shows up, like a new table without RLS after your AI builder changed the code. Cancel anytime.