Lovable · Bolt · Replit · v0
The tool that built your app can’t be the one that clears it.
Paste your app’s link. We look at it from the outside, then show you exactly what to fix.
Every other scanner tells you what’s broken. We’re telling you why that check can’t come from the platform, or from you.
Lovable, Bolt, Replit and v0 all ship their own security checks now. They’re not bad. They’re just marking their own homework — the same system that made the decision is the one deciding whether the decision was safe, and it will grade generously, because everything it did looked correct to it at the time.
This is not a new problem, and every serious industry solved it the same way: the thing that makes it doesn’t get to be the thing that certifies it.
- 01
Precious metal
A silversmith doesn't stamp their own silver. It goes to an assay office, which has no stake in the sale, and only then does it get a hallmark.
- 02
Electrical goods
A manufacturer doesn't decide their own kettle is safe. UL tests it. That's why the mark on the plug means something to the person buying it.
- 03
Food
A kitchen doesn't award itself a hygiene rating. An inspector who doesn't work there does, and the rating goes in the window.
Assay is that second opinion for software built with AI. We didn’t write your code, we can’t see it, and we have nothing to lose by telling you it’s broken.
Your app looks finished.
It runs. It signs people in. It takes payments. So you publish it — and ship the security holes that come baked into vibe-coded apps: your database left open to the public, a secret key sitting in the browser, endpoints anyone can call.
Looking finished isn’t being safe. You need an independent check that finds what’s exposed before your users — or an attacker — do.
export const supabase = createClient("https://xyzcompany.supabase.co","eyJhbGciOi…service_role…", // secret key in the browser);
The holes vibe-coded apps ship with, then one honest mark.
An outside opinion is only worth having if it’s a real one. Here’s what Assay actually looks at, from outside your app, with no login and no access to your code.
An open database
The most common vibe-coding failure: Supabase row-level security left off, so anyone can read — or change — every user’s data. Assay probes it the safe, read-only way and tells you exactly what’s reachable.
- profiles — open to the publicexposed
- orders — open to the publicexposed
- messages — protectedok
Exposed secrets
Secret keys, Stripe keys and tokens hiding in the JavaScript your app ships — found and flagged, never stored.
sk_live_•••••••••••• exposed
Safety score
Every finding rolls up into one number, worst issues first, so you know what to do before you know what it means.
92/ 100
Missing protections
The response headers a published app is meant to send and a generated one usually doesn't — the difference between a bug and a breach.
content-security-policy absent
And a list of things it will never do.
Assay reads. It never writes. Every check is a bounded, read-only request for something your app already serves to anyone with a browser — no exploit is ever sent, nothing is ever changed, and your users’ data is never copied or stored. When a check proves a database is readable, the values are masked in memory and never saved.
That’s a deliberate ceiling, not a missing feature. Assay is not a penetration test and never claims to be one — and it is the reason you can point it at a client’s live app without asking anyone’s permission first.
Three steps, no code required.
- 01
Paste your link
Drop in the URL of your live app. No install, no code to touch — Assay reads it the way the public does.
- 02
Watch it scan
Assay fetches your app the way a browser does and checks it live, right in front of you — for exposed keys, an open database, and missing protections.
- 03
Get your report + fixes
Every issue is explained in plain language — with the exact prompt to paste back into your builder. Clean apps earn the hallmark.
Or none of them
Let the agent that wrote it ask something that isn’t it.
Assay is an MCP server. Connect it to Claude Code, Cursor, or any MCP client and your coding agent can run the check itself, before the app ships — instead of you leaving what you’re building, visiting a website, and carrying the fix back by hand.
A model can’t clear its own work any more than a platform can. This is what it looks like when it stops trying to.
How to connect it →Two apps, judged two ways.
A mark you can trust because it says exactly what was checked and what was found — not a green light that means nothing.
No issues found
No secret keys in the browser. Database locked down — rows are protected. Security headers in place. This app earned the hallmark.
Issues found
Critical: your database is open to the public. Anyone can read every customer’s name, email, and order.
Turn on row-level security for the
profiles and orders tables, and add
a policy so users see only their own
rows.There is a third answer, and it is the one worth asking for. When a check cannot run, because the app sits behind a login we cannot follow or because we never find a database from the outside, the mark is withheld rather than granted. Nothing found and nothing checked are different results, and the report always tells you which one you got.
If you built it for someone else, the mark is the point.
“Yes, I checked it” is the builder vouching for their own build, and the client knows it. A dated report and a mark that re-checks itself is the version they can verify without trusting you — which is what makes it worth attaching to an invoice.
What to hand over →Free to start. Fair as you grow.
Free
One app, watched for good.
- 1 app, re-checked whenever you ship
- Email the moment a change breaks something
- 100 scans / month
- Plain-language report + paste-back fixes
- Saved scan history
Pro
RecommendedFor builders shipping every week.
- Unlimited apps, all watched
- 2,000 scans / month
- Weekly digest across everything you've shipped
- Priority scan queue
- Full scan history per app
Team
For teams that ship together.
- Everything in Pro
- 10,000 scans / month
- Up to 10 seats
- Shared apps across the team
- Audit log
Don’t ship it on a hunch.
Free to find out. Paste your link and get the first report in about a minute.