App Security Checker

Built with Lovable, Bolt, v0 or Replit? Find the warning signs your app shows every visitor, with a plain-English fix for each.

Get your free security check

Tell us where to send updates, then scan as many of your apps as you like.

Passive scan only: we read the public page and its JavaScript, like any browser would. We never log in, call your backend or read your data.

Secret keys shipped to the browser
Admin checks that only happen in the browser
Backend endpoints anyone can call

What you'll get

https://bookings-demo.example.com · built with Lovable

Critical risk

Critical 1High 1Medium 1Info 1

Critical

A secret key is shipped to every visitor

Your site's JavaScript contains a key that should only ever live on a server. With a Supabase service_role key, anyone can read, change or delete every row in your database, bypassing all security rules.

Supabase service_role key: eyJh••••••••Q3xk

How to fix: Rotate the key now in the Supabase dashboard, then move the code that uses it into an Edge Function.

High

Your app talks directly to backend endpoints anyone can call

The app sends booking data straight from the browser to a Google Apps Script URL. Anyone who copies the URL can call it too. We listed it but did not call it.

Google Apps Script: https://script.google.com/macros/s/AKfy••••/exec

How to fix: Put a server-side function in front of the endpoint that checks who the user is, and keep the real URL on the server.