For vibe coders shipping with Lovable, Bolt, Cursor & friends

Your AI-built app might be leaking keys. Find out in 60 seconds.

LockdownLaunch scans your live app the way an attacker would: leaked secrets in the JS bundle, open Supabase / Firebase data, exposed .env files, weak headers — then hands you a plain-English fix list you can paste back into your builder.

Scan my app free See a sample report

Read-only checks. Owner verification required for deep database probes. We never store your row data.

Free 60-second scan

Passive, public checks only — the same things any browser can see. We never query your database and never use any key we find.

This keeps happening to real apps

Not hypothetical. Recent, documented incidents from the same failure modes we scan for.

~10%

of Lovable apps scanned had inadequate Supabase Row Level Security — exposing user data, payments, and API keys via CVE-2025-48757 (170 of 1,645 projects).

Source: Matt Palmer disclosure · CVE-2025-48757
1.5M

agent API tokens exposed when Moltbook shipped a Supabase key with RLS off — plus tens of thousands of emails and private messages (Jan–Feb 2026).

Source: Wiz Research · Reuters
$1,000

API balance drained overnight after a key was left in frontend code — a pattern vibe coders hit repeatedly (plus Enrichlead’s public “guys, I’m under attack” Cursor SaaS shutdown).

Source: r/vibecoding · Enrichlead write-up

Scan. Fix. Verify.

Built for people who ship with AI and don’t want to become security engineers first.

1

Scan your live URL

We check headers, TLS, public JS bundles for provider secrets, exposed .env / .git / backups, and — after you prove ownership — Supabase RLS and Firebase rules.

2

Get plain-English fixes

Every finding says what an attacker could do, ranked by money and data risk, with a copy-paste prompt for Lovable, Cursor, or Bolt.

3

Re-scan until you’re green

Fix, re-run, and — when there are no criticals — claim a dated launch-ready certificate for that exact URL.

Simple pricing

One-time options for launch week. Watch if you keep shipping. Payments via Stripe (coming with early access).

Free scan

$0
  • Outside scan of your live URL
  • Headers, TLS, exposed files
  • Leaked-key patterns in JS
  • Grade + top issues
Join waitlist
MOST POPULAR

Launch Report

$49 one-time
  • Full ranked findings PDF
  • Fix prompts per finding
  • Owner-verified RLS / Firebase probes
  • 30-day re-scan
Join waitlist

Fix-It-For-Me

$149 one-time
  • Everything in Launch Report
  • Agent opens a fix PR / policy changes
  • Re-scan to prove it worked
  • Requires your GitHub or Supabase access
Join waitlist

Watch

$19 /mo
  • Weekly re-scan of up to 1 URL
  • Email only when something gets worse
  • Cancel anytime
Join waitlist

FAQ

Do you only scan apps I own?

Yes for deep checks. Free outside checks read public headers and JS like any browser. Supabase RLS and Firebase rules probes require ownership verification (DNS TXT lockdownlaunch-verify=… or a file at /.well-known/lockdownlaunch-…) plus your attestation. We refuse to deep-probe unverified targets.

Do you store my data or use my API keys?

No. We never call providers with leaked keys. Secrets are masked fingerprints in reports. Database probes request at most one row for a count header and discard the body — we do not store row contents. Scan artifacts are retained briefly for delivery, then deleted (target: 30 days).

What does the free scan check?

HTTPS and redirects, security headers, CORS, cookie flags, secret patterns in your public HTML and same-origin JavaScript (masked, never used or tested), whether /.env, /.git/config, or source maps are public (existence only), and whether you use Supabase or Firebase. Database and rules testing only happens in the paid report after you verify ownership.

What stacks do you support?

Any live web app. Tuned for Lovable, Bolt, v0, Cursor, Replit, Supabase, and Firebase — the places vibe-coded apps usually leak.

Is a good grade a security guarantee?

No. We catch common, high-impact mistakes. Apps handling payments, health, or regulated data still need a professional review. The launch-ready certificate only means “no criticals at scan time on this URL.”

When does scanning go live?

The free scan is live above. The full $49 report opens in waves — join the waitlist and you’ll get a link when your spot opens. No spam; one product email when ready.

Be first in line

Early access for founders shipping AI-built apps. We’ll email you when free scans open — no card required to join.

No spam — one email when the $49 report opens. Draft Privacy.