Secret keys in the page
OpenAI, Anthropic, Stripe, AWS, and a Supabase service role key. A public anon key is explained, not treated as a leak.
For founders shipping with Lovable, Bolt, v0, Replit, Cursor, and Claude Code
Is your vibe-coded app leaking data?
AI app builders ship fast. Sometimes they also ship your secret keys, a public database, or an .env file anyone can open. Paste your link. Deploy Safely looks only at what a stranger can already see.
What we look for
Files that should stay private
.env, .git, and source maps that publish your original code.
Databases left unlocked
Supabase tables or Firebase data that answer someone who is not signed in.
Basic browser protections
A few standard headers. Helpful, and much less urgent than a leaked key.
How a check works
01
Paste the public link
The address a customer would type. Not a dashboard login.
02
We read it like a visitor
The page, its scripts, and a few files that should never be public.
03
You get plain-language fixes
A grade, what it means, and a prompt you can hand to your AI builder.
Simple monthly plans
The first check is free. Paid plans remember your apps and tell you when a new edit opens a hole again.
Free check
$0
One public look at one link. No account.
- Secret keys, private files, and open databases
- A private report with fix prompts
- A shareable scorecard that hides the details
Starter
$19 / month
For one product and a couple of side projects.
- Save 3 apps
- A fresh check every day
- Email when a new issue shows up
- A short weekly summary
Pro
$49 / month
For a founder with a few live apps, or a small studio.
- Save 10 apps
- A fresh check every day
- Email when a new issue shows up
- A short weekly summary
You'll sign in with email before paying. Cancel anytime from the billing page. Prices are in US dollars.