A free health check for apps made with Lovable, Bolt, Replit or Cursor. In seconds: HTTPS and TLS, security headers, exposed files, and secret keys sitting in your JavaScript.
Free and passive: about 20 read-only requests to public URLs. Nothing on your site is changed.
Any public URL, including lovable.app, vercel.app, netlify.app and replit.app addresses. Nothing to install.
About 20 read-only requests and a TLS handshake: the same public URLs any browser can open. Nothing is submitted, guessed or attacked.
A grade from A+ to F in seconds. Verify you own the site to see exposed files and keys, and get the full report by email.
HTTPS works, HTTP redirects to HTTPS, the TLS certificate is valid and not about to expire, TLS 1.0 and 1.1 are switched off.
Strict-Transport-Security, Content-Security-Policy, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy, version disclosure and cookie flags. Scored like Mozilla's HTTP Observatory.
Files that should never be public: .env, .env.local, .git, .DS_Store, and source maps that publish your original code.
Live keys shipped to the browser: Stripe, OpenAI, Anthropic, AWS, GitHub, private keys and Supabase service_role keys.
Grades: A+ 95 and up, A 85, B 70, C 55, D 40, F below 40. A critical finding, such as a live secret key or an open .git folder, caps the score at 50 however good the rest is.
AI builders often put API keys straight into frontend code. Anything in your JavaScript can be copied by any visitor and used on your bill.
A Supabase service_role key in the browser bypasses Row Level Security. Anyone can read or delete every row.
No CSP, no HSTS, no clickjacking protection: defaults that a production app should have and generated apps rarely do.
Velura Rescue fixes and runs apps built with AI coding tools. Start with a Rescue Sprint on what your scan found.
We fix what the scan found: rotate exposed keys, move secrets server-side, lock down database rules and headers.
Auth, payments, error tracking, backups and tests, so the app survives real users.
We host, monitor and maintain it, and keep shipping the features you would have prompted for.
Yes. It only makes plain GET requests to public URLs, the same ones any browser or search crawler can open, plus one TLS handshake to read the certificate. It doesn't log in, submit forms, guess passwords or try exploits, and it makes about 20 requests in total. Please only scan sites you own or have permission to test; the form asks you to confirm that.
The exposure and secrets checks can find things an attacker would love, like a live Stripe key or an open .git folder. So we show everyone the counts, but only show which file or key is exposed to someone who has proved they control the site, by adding a file, a meta tag or a DNS TXT record. Grade, headers and TLS findings are visible to anyone with a browser, so those are shown to everyone.
Any public web app, but it's built for apps made with AI coding tools like Lovable, Bolt, Replit, v0 and Cursor, which often ship with keys in the frontend, open database rules and missing security headers.
No. Those are designed to be public, so we report them as information only. What protects your data is Row Level Security in Supabase and Security Rules in Firebase. A Supabase service_role key in the browser is a different story: it bypasses those rules entirely.
Never in full. We keep only the type of key and its last four characters, so you can tell which one to rotate. Results are cached for 24 hours.
A fixed-scope sprint where our engineers fix the issues in your report, rotate exposed keys, move secrets to the server, lock down your database rules and add the missing headers, then hand back a clean report.