Secret keys in the bundle
Service role keys and private API keys for Stripe, OpenAI and others that should never ship to the browser.
APP EXPOSURE CHECK
What can any visitor already reach in your app?
A free security check for apps built with Lovable, Bolt, v0 and Cursor. Paste your URL and see the API keys, source maps and config files any visitor can already reach. The report shows in your browser, not by email.
No login. No keys. Nothing to install. The check reads only what your app already serves to every visitor.
How it works
- 1
Paste your app address
The public URL people already use. No account, no keys, no access to your code.
- 2
The check reads the public surface
It downloads your pages and scripts, the same files any visitor's browser loads, and looks through them.
- 3
You read the report
Findings ranked by severity, each with what was found, where, and what to change. In under a minute.
What the check covers
Everything here is reachable by any visitor, found by reading the files your app already serves in public.
Open config files
/.env and /.git left reachable by anyone, with every value and the full source history inside.
Source maps
Production source maps that hand your original code to any visitor.
The stack you run on
Supabase, Firebase and Stripe, and the builder behind the app: Lovable, Bolt, Base44, Vite, Next.js.
Reachable Supabase tables
Which tables the public key can see from outside. No rows are read.
Database connection strings
A full Postgres, MySQL or MongoDB URL with its password left in the client, which opens the database directly, past every API rule.
What it does not see
The check reads your app from the outside, like any visitor. Some things are only visible from inside, and it says so rather than guessing.
- Your database access rules (RLS). Whether your rows are actually protected is decided inside the database, not from outside.
- Server routes, edge functions and webhooks.
- Pages behind sign-in, and scripts loaded only after sign-in.
- Scripts served from other domains.
After the check
The free check shows what is exposed from the outside. A full audit goes inside: it reads your database rules and server code, decides what to fix first, and I write and test the changes with you.
Questions
What happens to the URL I paste?
It is checked in the moment and not stored. The check keeps nothing.
Is it safe to run on my app?
Yes. It only reads what your app already serves to every visitor and changes nothing.
Do I need to install or connect anything?
No. One public URL is all it needs. No account, no keys, no access to your code.
Which sites can I run it on?
Run it on an app you own or are authorised to check. It reads only the public surface of the address you enter.
How is this different from a full audit?
The free check shows what is exposed from the outside. A full audit reads your database rules and server code by hand, grades every finding and sets the order to fix them.
Use this check only on an app you own or are authorised to check. It reads only the public surface of the address you enter and makes no changes. The check is provided as is, without warranty; any decision or change you make to your app is your own.