About 72,000 user images exposed, including ID photos
A storage bucket was left open to the public internet, and private photos were downloaded and shared.
Checked by SafeLaunch: publicly readable storage and data
Results in about 30 seconds
Find the security holes in your AI-built app before your users do.
SafeLaunch checks apps made with Lovable, Bolt, Replit, Cursor and v0 for leaked keys, open databases and hidden malware. Every finding comes in plain English with the exact prompt to fix it.
No account neededFree re-scans for 7 daysWe never store your code
Not ready to scan? Take the free 2-minute assessment
acme/invoice-app · 214 filesComplete
92/100
Fix first: 1 item before launch
- Secrets and API keys in code0 found
- Hidden code in config filesclean
- Database access rules (RLS)enforced
- Vulnerable packages (OSV)0 known
- Security headers on live site1 fix
- Secret files publicly downloadableprivate
1 fix before launch: add a Content-Security-Policy headerPrompt: "Add a strict Content-Security-Policy header in next.config.js…"
Example scan of a sample app
Checks mapped toOWASP Top 10CWEOSV vulnerability databaseSupabase RLS best practice
Why this matters
AI tools write the code fast. They don't check it.
Two real incidents and one easy mistake. SafeLaunch checks for every one of them.
Over 170 Lovable-built apps leaked user data
Databases had missing access rules, so anyone with the public key could read other users' records.
Checked by SafeLaunch: Supabase tables without row-level security
Secret keys shipped to the browser
Stripe and OpenAI secret keys pasted into front-end code are visible to anyone who opens the page source.
Checked by SafeLaunch: secrets in client code and committed .env files
Sources: public reporting on the Tea breach (July 2025) and the NVD entry for CVE-2025-48757.
How it works
Paste a link. Get a report. Fix it with one prompt.
Step 1
Paste your repo
Any public GitHub repository. Add your live site to check it too.
github.com/you/your-appStep 2
Get a clear verdict
A score out of 100 and one of three verdicts: safe to launch, fix first, or do not launch.
92/100 · Safe to launchStep 3
Fix with your AI
Copy the prompt for each finding into the tool that built your app. Re-scan free for 7 days.
"Move the Stripe key to a server-only…"What we check
The mistakes that actually get AI-built apps breached.
CWE-798
Leaked keys and secrets
Stripe, OpenAI, AWS, GitHub and database master keys in code or committed .env files.
OWASP A01
Open databases
Supabase tables without row-level security, and admin keys shipped to the browser.
CWE-506
Hidden malicious code
Obfuscated scripts tucked into config files that run every time you build.
OWASP A06
Vulnerable packages
Dependencies with publicly known security holes, checked against the OSV database.
OWASP A05
Live site setup
HTTPS, security headers, and secret files left downloadable on your domain.
AI inventory
Where your users' data goes
Which AI providers receive user data, and unsafe model files in the repo.
Pricing
One scan for $19. Weekly protection for $29.
New code means new risks. Monitor re-checks your app every week and emails you when something new turns up.
Readiness assessment
Free
A 2-minute quiz that shows your likely risks, based on how your app is built.
- Risk score and top 3 risks
- No code needed
SafeLaunch Scan
Most popular$19 one-time
A full scan of your code and live site.
- All six check categories
- Score, verdict and fix prompts
- Free re-scans for 7 days
- "Verified by SafeLaunch" badge when you pass
Monitor
$29 / month
The scan, repeated every week. Or $290 a year.
- Weekly re-scan of repo and site
- Email alerts with fix prompts
- Your $19 scan credited to month one
- Cancel from any email
Questions
Before you scan
Do you store my code?+–
No. We read your public repository to run the checks and keep only the results: the score, the findings and the file names they point to.
Is this a guarantee my app is secure?+–
No tool can promise that. SafeLaunch is an automated check that catches the common, serious mistakes behind most breaches of AI-built apps. It isn't a full manual audit.
I'm not technical. Will I understand the report?+–
Yes. Every finding explains the problem in plain English and gives you a prompt to paste into Lovable, Bolt, Replit, Cursor or whichever tool built your app.
What do I get for $19?+–
A full scan of one app (your repository, plus your live site if you add it), the complete report with fix prompts, and free re-scans of that app for 7 days so you can confirm your fixes.
Can I scan a private repository?+–
Not yet. Private repositories are coming soon. Today SafeLaunch scans public GitHub repositories and any live site.
How do I cancel Monitor?+–
Every Monitor email has a "Manage or cancel" link. One click opens your billing page, where you can cancel immediately.
Every day a leaked key stays live is a day someone can use it.
Find out in 30 seconds, for $19.