Question 1

What does a check actually look at?

Accepted Answer

The public page, the JavaScript files that page loads, a short list of well-known private files such as .env and .git, browser safety headers, and — only if your page already includes them — a Supabase or Firebase project. We do not guess passwords or hunt for hidden pages.

Question 2

Will this change or break my app?

Accepted Answer

No. A check only reads. It does not log in, submit forms, or change data. Database checks ask for a single row with the public key already in your page, then throw that row away.

Question 3

Do you store the secret keys you find?

Accepted Answer

No. The report names the kind of key and where it showed up, with only a short masked hint. We do not keep the key, the database row, or the contents of a private file.

Question 4

My report mentions a Supabase anon key. Is that bad?

Accepted Answer

Usually no. The anon key is designed to live in the browser. The dangerous key is the service role key, which skips every lock. A table that returns rows to someone who is not signed in is also a problem, even when the anon key itself is fine.

Question 5

I don't know how to code. What do I do with a finding?

Accepted Answer

Each finding includes a fix prompt. Copy it into Lovable, Bolt, v0, Replit, Cursor, Claude Code, or whichever tool built the app, and ask it to make the change. Then run the check again.

Question 6

Why do you ask me to prove I own the site?

Accepted Answer

The free check stays on the public surface. Saved apps, daily checks, and anything beyond that one-time look require a tag on your homepage or a small file on your site, so we know the site is yours.

Question 7

Does a good grade mean my app is safe?

Accepted Answer

No. A grade describes this public check only. It can miss issues on the server, in a private admin tool, or in a page we did not open. Treat it as an early warning, not a security certificate.

Question 8

Which builders does this work with?

Accepted Answer

Any public website. It is aimed at apps made with Lovable, Bolt, v0, Replit, Cursor, and Claude Code, because those tools ship fast and sometimes ship a secret along with the feature.

Questions founders ask