Free tool · no sign-up
Is your AI-built app safe to launch?
Short answer
The Theepa launch safety scan reads the same public files any visitor's browser downloads and runs 13 checks in five groups (Secrets, Source code, Database rules, Security headers, Launch polish). It scores your app out of 100 and gives one of four verdicts: Do not launch yet, Fix before launch, Fix before you scale, or Ready to launch. Exposed keys are masked, nothing is stored, and it never touches your database.
A free first check before you pay for a security review. Built for founders who shipped an MVP with Lovable, Bolt, v0, Replit or Cursor. In a June 2026 scan of 1,072 apps built this way, 98% had at least one security flaw and 16% let anyone delete database records. Most of those problems are visible from the outside, which is where this scan looks.
theepa.studio/tools/launch-safety-scan/Launch safety scan report
Generated · Theepa Studio · Brand identity and web design studio, Dubai
Runs in your browser and stores nothing. theepa.studio’s own result is checked live; for your app, paste its page source, and its headers and main JavaScript file if you have them.
Scanning theepa.studio…
Opens your print window. Choose “Save as PDF” as the destination.
Want help acting on this?
Book a free call: theepa.studio/intro · info@theepa.studio
This report was made with Launch safety scan, a free tool by Theepa Studio. Results come from the inputs on the page when it was saved.
How it works.
The method behind the numbers, so you can judge the result.
- Secrets (40): secret API keys for OpenAI, Anthropic, Stripe, AWS, GitHub, Resend and 10 other services; a Supabase service_role or secret key; database passwords and private keys.
- Source code (15): downloadable source maps, and settings named like secrets (VITE_, NEXT_PUBLIC_) compiled into browser code.
- Database rules (15): if your app talks to Supabase or Firebase from the browser, a step-by-step self-test you confirm in your dashboard. The scan never queries your database.
- Security headers (20): HTTPS with HSTS, a Content Security Policy, clickjacking protection, nosniff, and referrer and permissions policies.
- Launch polish (10): files loaded over plain HTTP, and starter-template leftovers such as a default title or the builder's share image.
- Verdicts: any exposed secret means Do not launch yet. Otherwise 90+ is Ready to launch, 60–89 Fix before you scale, under 60 Fix before launch. Checks we couldn't run are left out of the score.
Sources
Launch safety scan: questions
Is it safe to put my app's URL in here?
Yes. The scan only downloads public files, the same HTML and JavaScript any visitor's browser gets. It doesn't log in, submit forms or query your database. Any key it finds is masked on screen and in the PDF, and nothing is stored.
My Supabase anon key was found. Is that a problem?
No. The anon or publishable key is meant to be public. What protects your data is Row Level Security. The problem is the service_role or secret key: it skips every rule, so it must never reach the browser.
What should I do if it finds a secret key?
Revoke the key in that provider's dashboard and create a new one, then move the code that uses it into a server function. Deleting it from your code isn't enough, because old builds and caches still contain it.
Does a high score mean my app is secure?
No. It means there are no obvious leaks from the outside. The scan can't see server code, login and payment logic, or what your database returns to a logged-in user. That needs a code review.
Why couldn't it fetch my app?
Some hosts block automated requests. Use the paste option: copy your page source, and optionally your response headers and main JavaScript file, and the scan runs in your browser.
Does it work with Bolt, v0, Replit and Cursor apps?
Yes. It works on any public website. The Supabase, Firebase and starter-template checks are tuned for the AI app builders founders use most.
Want it done for you?
AI MVP cleanup: Your vibe-coded MVP, made ready for real users.
Tell us what you're building.
A 30-minute call. We look at your brand and site together, and you leave with a plan and a fixed price, whether or not you hire us.