Check your app before you share the link.
Paste your app’s address. We look at it the way strangers, Google and ChatGPT do, and flag leaked keys, open files, search blockers and starter-template leftovers. Every problem comes with a prompt you can paste into Lovable, Bolt, Cursor or Claude Code.
How it works
Paste your address.
Your live app, preview link or custom domain. No signup.
We look from the outside.
We load your page and a few standard addresses (like
/robots.txtand/.env), read your JavaScript for keys, and ask Google Lighthouse to test it on a phone.Paste the fixes into your AI tool.
Each problem has a ready-written prompt. Copy one, or copy them all, into Lovable, Bolt, Cursor or Claude Code.
What we check
Six groups of checks. These are normal leftovers of building fast, and each one comes with a prompt to fix it.
Leaked keys and files
A key in your public code is a key anyone can use, on your bill.
- Your .env files can’t be downloaded
- Your .git folder isn’t public
- No secret keys in your public code (Stripe, OpenAI, Anthropic, OpenRouter, AWS, GitHub, Supabase secret, SendGrid, Slack, private keys)
- Google keys are locked to your domain
- Supabase tables have Row Level Security (we flag it; you check it)
- Firebase rules aren’t open (we flag it; you check it)
- Your original source code isn’t downloadable
- No stray Mac system files
Security basics
These settings tell browsers how to protect your users.
- Always on HTTPS
- Browsers remember to use HTTPS
- A policy limits what scripts can run
- Other sites can’t embed your app in a hidden frame
- Browsers don’t guess file types
- Page addresses don’t leak to other sites
- Cookies are locked down
- Other websites can’t read your users’ data
- No insecure http:// files
- Your server doesn’t announce its software
Google and AI tools
If Google and ChatGPT can’t read your page, nobody finds you.
- Search engines are allowed to list you
- robots.txt lets them in
- A sitemap lists your pages
- Your content exists without JavaScript
- A real page title
- A description under your Google link
- Shared links show a preview card
- Google knows your main address
- Missing pages return a real 404
- AI assistants can read your site
- An llms.txt introduces you to AI tools
- Structured data describes your app
- One main heading
- The page declares its language
- Google’s own SEO audit passes
Launch polish
These are what people notice in the first five seconds.
- No starter-template leftovers
- You’re on your own domain
- It fits on a phone screen
- Your tab has an icon
- Bug reporters know how to reach you
- People using screen readers can use it
Speed
Slow apps lose people before they see anything.
- Your server answers quickly
- The page itself is lightweight
- Your JavaScript is a reasonable size
- It loads fast on a phone (Google Lighthouse)
Email from your domain
Without these, anyone can send email that looks like it’s from you.
- Only your services can send email as you (SPF)
- Inboxes reject fake email from your domain (DMARC)
Checked only on your own domain, not on shared addresses like lovable.app.
What we can’t see
We only see what’s public. We can’t see your server code, your database rules, what’s behind your login, or how your app handles payments. A clean result means your public front door is in good shape, not that your app is fully secure.
Sample report for a made-up app
This is what a result looks like. Open any line to read what we found and copy its fix prompt.
tidyinvoice.examplea made-up app
Your summary appears here as soon as the first two checks are in.
Not ready to share yet.
1 thing to fix now and 1 to check yourself. 16 more are worth fixing when you can. 2 are optional.
Tip: if your AI tool gets confused, paste one fix at a time. It also uses fewer credits.
Same results as a moment ago. Changes you’ve just deployed can take up to 10 minutes to show here.
Fix these first
- No secret keys in your public codeFix now
Anyone can copy these from your site: Stripe secret key sk_live_51… in index-B7xQ2.js. Rotate them now, then move them to a server function. Deleting them from the code doesn’t un-leak them.
Paste this into Lovable, Bolt, Cursor or Claude Code
Secret keys are visible in my app’s public JavaScript. 1) Find every place in my code that uses a secret key in the browser. 2) Move each call that needs a secret into a server-side function (an API route or edge function) so the browser never sees the key. 3) Remind me to rotate each exposed key in its provider’s dashboard, because removing it from the code doesn’t un-leak it.
- Every Supabase table has Row Level SecurityCheck yourself
Your app uses Supabase, and its public key is visible in your code. That’s normal, but it means Row Level Security is the only thing stopping strangers from reading or changing your data. We won’t test this without your permission, so check Supabase › Advisors › Security now.
How to check: Open Supabase, then Advisors, then Security.
Paste this into Lovable, Bolt, Cursor or Claude Code
My app uses Supabase. For every table, check that Row Level Security is enabled and that the policies only let users read and change their own rows. List any table without RLS, or with a policy that allows everyone, and write the SQL to fix each one.
Leaked keys and files
1 to fix now, 1 to check yourself, 3 clear
Also listed in Fix these first.
Anyone can copy these from your site: Stripe secret key sk_live_51… in index-B7xQ2.js. Rotate them now, then move them to a server function. Deleting them from the code doesn’t un-leak them.
Paste this into Lovable, Bolt, Cursor or Claude Code
Secret keys are visible in my app’s public JavaScript. 1) Find every place in my code that uses a secret key in the browser. 2) Move each call that needs a secret into a server-side function (an API route or edge function) so the browser never sees the key. 3) Remind me to rotate each exposed key in its provider’s dashboard, because removing it from the code doesn’t un-leak it.
Also listed in Fix these first.
Your app uses Supabase, and its public key is visible in your code. That’s normal, but it means Row Level Security is the only thing stopping strangers from reading or changing your data. We won’t test this without your permission, so check Supabase › Advisors › Security now.
Paste this into Lovable, Bolt, Cursor or Claude Code
My app uses Supabase. For every table, check that Row Level Security is enabled and that the policies only let users read and change their own rows. List any table without RLS, or with a policy that allows everyone, and write the SQL to fix each one.
We tried the usual .env paths. None of them are public.
Your .git folder isn’t reachable from the web.
No public source maps found.
Security basics
4 worth fixing, 6 clear
No Strict-Transport-Security header, so a browser can still try plain HTTP first, where traffic can be intercepted.
Paste this into Lovable, Bolt, Cursor or Claude Code
Add the response header "Strict-Transport-Security: max-age=31536000; includeSubDomains" to every page of my app. Show me where it goes for my hosting (Vercel, Netlify, Cloudflare or my own server) and don’t change anything else.
No Content-Security-Policy header. If someone manages to inject a script, nothing stops it from running.
Paste this into Lovable, Bolt, Cursor or Claude Code
Add a Content-Security-Policy header to my app. Start in Report-Only mode with a policy that allows only my own domain plus the third-party services my code actually uses (check my code to list them). Avoid 'unsafe-inline' for scripts. Then explain how to switch from Report-Only to enforced after testing.
Any website can load your app inside an invisible frame and trick your users into clicking things (clickjacking).
Paste this into Lovable, Bolt, Cursor or Claude Code
Stop other websites from embedding my app in an iframe: add the header "X-Frame-Options: DENY" and the CSP directive "frame-ancestors 'none'". Show me where to set it for my hosting.
No Referrer-Policy header. Full page addresses, including any tokens in them, can be passed to sites you link to.
Paste this into Lovable, Bolt, Cursor or Claude Code
Add the header "Referrer-Policy: strict-origin-when-cross-origin" to every response in my app.
http:// visitors are redirected to https://.
X-Content-Type-Options is set to nosniff.
No cookies are set on the first visit.
Your page doesn’t share itself with other websites.
Everything on the page loads over HTTPS.
No software names or versions in your headers.
Google and AI tools
7 worth fixing, 1 optional, 6 clear
Your HTML has no readable text at all. Everything is drawn by JavaScript. Google renders it later, if at all, and most AI crawlers (GPTBot, ClaudeBot) don’t run JavaScript, so to them your page is nearly empty.
Paste this into Lovable, Bolt, Cursor or Claude Code
My pages are blank until JavaScript runs, so most AI crawlers and some search engines see almost nothing. Make my public pages (home, pricing, about, blog) render real HTML at build time using prerendering or static site generation for my framework. Keep the logged-in app as it is.
Your title is still the starter template’s “Vite + React + TS”. That’s what Google and browser tabs show.
Paste this into Lovable, Bolt, Cursor or Claude Code
Give every page in my app a unique, descriptive <title> under 60 characters that says what the page is and includes my app’s name. Start with the home page.
Your description is still the template’s “Lovable Generated Project”.
Paste this into Lovable, Bolt, Cursor or Claude Code
Write a meta description under 155 characters for my home page and each main page. Say what my app does and who it’s for, in plain words, as <meta name="description">.
A made-up address on your site returns “200 OK” instead of “404 Not Found”, so Google may index junk pages.
Paste this into Lovable, Bolt, Cursor or Claude Code
My app returns HTTP 200 for pages that don’t exist. Make unknown addresses return a real 404 status with a friendly not-found page. If my hosting rewrites everything to index.html, keep that for real app routes but return 404 for everything else.
No sitemap at /sitemap.xml or in robots.txt. Google finds new pages more slowly without one.
Paste this into Lovable, Bolt, Cursor or Claude Code
Generate a sitemap.xml listing all public pages of my app, serve it at /sitemap.xml as XML, and reference it in robots.txt. If my pages change, generate it at build time.
No canonical link. If your app is reachable at several addresses (www, preview links), Google may split your ranking between them.
Paste this into Lovable, Bolt, Cursor or Claude Code
Add a canonical link tag to every page pointing to its address on my main domain, for example <link rel="canonical" href="https://mydomain.com/page">. Never point it at preview or platform addresses.
No structured data (JSON-LD). It helps Google and AI tools understand what your app is.
Paste this into Lovable, Bolt, Cursor or Claude Code
Add JSON-LD structured data to my home page describing my app (schema.org WebApplication with name, description, url, and offers if it’s paid) in a <script type="application/ld+json"> tag.
Optional: an llms.txt file gives AI assistants a clean summary of what your app does.
Paste this into Lovable, Bolt, Cursor or Claude Code
Create an llms.txt file at the root of my site: a short Markdown summary of what my app does, who it’s for, and links to my most important pages, following the llms.txt format.
Nothing tells search engines to stay away.
Your robots.txt allows crawling.
Shared links show a title and image.
ChatGPT, Claude, Perplexity and Google’s AI crawlers are allowed in.
Language set to “en”.
Lighthouse SEO score: 92/100.
Launch polish
2 worth fixing, 1 optional, 3 clear
We found Lovable’s default share image and the author set to “Lovable”. Visitors see these when your link is shared or bookmarked.
Paste this into Lovable, Bolt, Cursor or Claude Code
Remove the leftovers from my starter template: replace the default page title, meta description, author, twitter:site, share image and favicon with my own app’s name, description and branding. Search my index.html and layout files for "Vite", "Lovable", "Create Next App" and similar.
Lighthouse accessibility score: 78/100.
Paste this into Lovable, Bolt, Cursor or Claude Code
Improve my app’s accessibility: alt text on images, labels on form fields, enough color contrast, and an accessible name on every button and link. Fix the issues a Lighthouse accessibility audit reports.
Add /.well-known/security.txt so people who find a bug can tell you privately instead of posting it.
Paste this into Lovable, Bolt, Cursor or Claude Code
Create /.well-known/security.txt for my site with a Contact line (an email for security reports) and an Expires date one year from today, following RFC 9116.
tidyinvoice.example is your own address.
A mobile viewport is set.
An icon is declared.
Speed
2 worth fixing, 2 clear
Google Lighthouse mobile score: 61/100. Main content appears at 4.1 s, the page is blocked for 380 ms, layout shift 0.02.
Paste this into Lovable, Bolt, Cursor or Claude Code
My mobile Lighthouse performance score is low. Fix the biggest issues first: resize and compress images (modern formats, width and height set), lazy-load content below the fold, defer non-critical scripts, and cut JavaScript from the first load.
812 KB of JavaScript before compression. Phones have to download and run all of it before your app responds.
Paste this into Lovable, Bolt, Cursor or Claude Code
My JavaScript bundle is large. Analyze it and shrink it: lazy-load routes and heavy components, remove unused libraries, and swap big dependencies for lighter ones. Show me the biggest wins first.
Your page arrived in 212 ms.
3 KB of HTML.
Email from your domain
1 worth fixing, 1 clear
No DMARC record, so inboxes have no instructions for fake emails that use your domain.
Paste this into Lovable, Bolt, Cursor or Claude Code
Help me add a DMARC record for my domain. Start with p=quarantine and a reporting address, and explain how to move to p=reject once my real email passes.
SPF is set: v=spf1 include:_spf.google.com ~all
Questions
Will you see my code?
Only the parts every visitor’s browser already downloads: your page and up to five of your own JavaScript files. We don’t connect to your repo or your AI tool, and we can’t see anything behind a login.
Is it safe to run on my live app?
Yes. We only make the same kind of requests a browser makes when it opens a page. We never submit forms, log in, or change anything.
Do you keep the keys you find?
No. When we find a key, we show only its first few characters, like sk_live_51…, and we never return the contents of exposed files. Results are kept for up to 10 minutes so a repeat check is fast, then they’re gone.
Lovable already scanned my app. Do I need this?
Lovable checks your project before you publish. We check the live site from the outside after it’s published, and we also cover Google, AI tools, link previews, email and speed. They work well together.
Why don’t you test my Supabase tables?
Testing whether strangers can read your database means trying to read it, and we won’t do that without your permission. Today we tell you when your app uses Supabase or Firebase, so you know exactly what to check. A permission-based test is coming soon.
Does a clean result mean I’m secure?
No tool can promise that from the outside. It means the things anyone can see are in good shape. See what we can’t see.
Is it really free?
Yes. The checker is free with no signup. The waitlist is only for the features marked “coming soon”.
Can I check a site that isn’t mine?
We only look at public pages anyone can open. Please use it on your own apps, or with permission.
Coming soon
Database lock test, with your permission Coming soon
Prove you own the app, and we’ll check whether strangers can read your Supabase tables.
Weekly re-check and email alerts Coming soon
Know when a new prompt quietly breaks something that used to pass.
About our checker
ViberschecklistBot visits a site only when someone asks us to check it. It makes ordinary GET requests, the same as opening a page, and loads a short list of public addresses. It never logs in, submits forms, or changes anything.
It identifies itself as ViberschecklistBot/0.1 (+https://viberschecklist.com/#bot)