Free website security check
Is your site leaking something? If you built it in Lovable, Replit, Bolt, v0, or Claude Code, it's easy to ship an API key or leave a door open without realizing it. Paste your address below for a free, instant first-pass check. No signup.
We only look at what your site already shows the public — the same things any visitor's browser can see. We don't log in, test, or attack anything.
What we check
The check runs four passes over your public surface. Each one targets a mistake we see again and again in apps that shipped fast.
Exposed API keys and secrets
We scan your page and its first-party JavaScript for credentials that should never be public — Stripe secret keys, AWS keys, OpenAI and Anthropic keys, private certificates. These are the mistakes that drain a bank account or rack up a five-figure API bill overnight. We're honest about severity: a leaked sk_live_ Stripe key is an emergency, but a publishable pk_live_ key, a Firebase config, or a Supabase anon key is supposed to be public — so we tell you that instead of crying wolf.
Security headers
Browsers respect a handful of headers that quietly protect your visitors — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Vibe-coded apps almost never set them, which leaves the door open to clickjacking, content sniffing, and downgrade attacks. We check which ones you have and which are missing.
HTTPS, certificates, and cookies
We confirm your site forces HTTPS, redirects insecure traffic, and isn't running on an expired certificate. We also check whether your cookies are marked Secure, HttpOnly, and SameSite — the difference between a session token that's safe and one that's one bad script away from being stolen.
Leaky files
We probe for the files that should never ship — .env files full of secrets, exposed .git folders that hand over your entire source history, and source maps that un-minify your code for anyone curious. We verify each one is a real exposure and not just a single-page app returning its homepage for every URL — so a finding here means something is actually wrong.
What your grade means
We start every site at 100 and subtract for what we find — a critical issue costs 40 points, a should-fix 12, a minor one 4. Informational notes don't cost anything.
- A
- 90–100
Looking solid. The obvious mistakes aren't here.
- B
- 75–89
Mostly good, with a few things worth tightening.
- C
- 55–74
Some real gaps. Fixable, but worth doing soon.
- D
- 35–54
Several issues, including ones that could expose data.
- F
- under 35
Serious problems found. We'd treat this as urgent.
A sample scorecard
Here's what a typical first check looks like — a grade up top, then the findings in plain language, worst first.
Security check for
yoursite.com
Some real gaps. Fixable, but worth doing soon.
This is a surface-level check — it only sees what a browser can see. It can't test your login, your database rules, or your server-side code.
Exposed Stripe secret key
CriticalA live Stripe secret key was found in your JavaScript. Anyone can use it to charge cards and read your payment data. Rotate it now and move it server-side.
sk_live_••••••••
Missing Content-Security-Policy header
Should fixNo CSP header is set, so the browser will run any script that ends up on the page. A policy is one of the cheapest defenses against cross-site scripting.
1 informational note (nothing to fix)
Stripe publishable key in page
We found a pk_live_ key. This one is meant to be public — it's how Stripe's checkout works in the browser. Nothing to do here.
Frequently asked questions
Is this website security check really free?
Yes. There's no signup, no credit card, and no email required. Paste your site's address and you get a grade and a list of findings in a few seconds. We build and harden vibe-coded apps for a living, so the free check is just how people meet us.
How do I check if my Lovable app is secure?
Paste your Lovable app's public URL into the box above and run the check. We look at the same things a visitor's browser can see — exposed API keys, missing security headers, leaky files — and flag anything that's a real risk. It's the fastest way to catch the common mistakes that Lovable, Replit, Bolt, and v0 apps ship with.
Can you check my site for exposed API keys?
That's the first thing we look for. We scan your page and its JavaScript for secret keys — Stripe sk_live_, AWS, OpenAI, Anthropic, private certificates — and flag them as critical. We also tell you when a key is supposed to be public, like a Stripe publishable key or a Supabase anon key, so you don't panic over a non-issue.
Is it safe to run? Will it attack my site?
It's completely passive. We only look at what your site already shows the public — the same surface any visitor's browser sees. We don't log in, submit forms, run exploits, or attack anything. Running the check can't break your site.
What's a good security score?
We grade A through F. An A means the obvious mistakes aren't there; an F means we found something we'd treat as urgent, like an exposed secret key. Most vibe-coded apps land in the C-to-D range on their first check, usually because of missing security headers — which are quick to fix.
Does a passing grade mean my app is fully secure?
No, and we won't pretend otherwise. This is a surface check — it sees what a browser can see. It can't test your authentication logic, your database rules, or your server-side code. A clean grade is a good sign, but a real audit goes deeper. If your app handles real customers or money, that's the part we do for you.
How is this different from a full security audit?
The free check is automated and looks at your public surface in seconds. A full audit is us, by hand, going through your auth, your data-access rules, your payment flow, and the code a browser never sees. The free check tells you whether you have obvious problems; the full audit tells you whether your app is actually safe to put in front of customers.