What can your visitors already see?
Lovable, v0, Bolt and Cursor build the demo. They don't lock the door behind it. Paste your address and find out what's standing open.
Free, no sign-up. Only looks at pages your visitors can already see.
What it looks for
Nine checks, all of them things an AI builder skips because nothing in the prompt asked for them: whether an API key ended up in the JavaScript your visitors download, whether the security headers browsers rely on are set, whether the site is still on the builder's own domain, whether a wrong URL produces a proper 404 or a server error, whether it works on a phone, and whether a link to it looks like anything when posted. The one that matters most is the first: a key in the bundle is public the moment it ships, and it is billed to you.
Frequently asked questions
Does this touch my site in any way?
No. It requests your home page, up to six script files that page already tells browsers to download, and one URL that doesn't exist so it can see how you handle a 404. That's eight or nine requests — fewer than one visitor makes. It doesn't log in, submit anything, or try to find a way in.
Is it safe to check someone else's site?
It only reads pages that are already public, so yes — but be sensible about what you do with the result. Telling someone their API key is exposed is a favour. Using it is a crime. If you're checking a site you don't own, tell the owner what you found and leave it there.
Will it show me the key it found?
No, on purpose. If a key really is exposed, repeating it in a web response, a screenshot or a log spreads the exposure further. You'll be told which kind of key it is and which file it was in, which is enough to find it in your own code.
It said my site is fine. Is it?
It said nothing is wrong from the outside. It can't see your code, your database rules, who can reach your admin pages, or what happens after someone signs in — and that's where the expensive problems usually live. A clean result here means the obvious things are right, not that you're done.
It flagged something that isn't a problem.
That happens — a key that's meant to be public, a header your host sets somewhere this check can't see. The checks look for shapes, and shapes are sometimes wrong. Tell me which one and I'll fix the check; that's worth more to me than being right this time.
What does it cost?
Nothing, and there's no account. My reply to a report you send me is free too, whether or not you hire me. If you want one of the findings gone, the Quick Fix is $99 and done the same day.