IndependentOne check across Lovable, Bolt, Replit & v0
The independent check for AI-built apps.
Real users. Real payments. Real data. The tool that wrote your code can’t be the one that vouches for it — Assay is the outside check that proves your app is safe, in plain English, with the exact fix for anything it finds.
Scan · my-saas.lovable.app
Safe to publish
None exposed
RLS enforced
All present
No critical or risky issues found. This app earned the hallmark.
Scans apps built with
- Lovable
- Bolt
- Replit
- v0
- Supabase
- Next.js
- Firebase
- Stripe
Your app looks finished.
It runs. It signs people in. It takes payments. So you publish it — and ship the security holes that come baked into vibe-coded apps: your database left open to the public, a secret key sitting in the browser, endpoints anyone can call.
Looking finished isn’t being safe. You need an independent check that finds what’s exposed before your users — or an attacker — do.
export const supabase = createClient("https://xyzcompany.supabase.co","eyJhbGciOi…service_role…", // secret key in the browser);
The holes vibe-coded apps ship with, then one honest mark.
Open database
Your database, locked down
The most common vibe-coding failure: Supabase row-level security left off, so anyone can read — or change — every user's data. Assay probes it the safe, read-only way and tells you what's exposed.
- profiles — open to the publicexposed
- orders — open to the publicexposed
- messages — protectedok
Exposed secrets
Keys that shouldn't ship
Secret keys, Stripe keys, and tokens hiding in your app's code — found and flagged, never stored.
Safety score
One number to act on
Every finding rolls up into a single score, worst issues first.
The verdict
A clear yes or no
No critical or risky issues? You get a clean bill of health — safe to publish. Anything unsafe is Held, with the exact fix to paste back.
Three steps, no code required.
- 01
Paste your link
Drop in the URL of your live app. No install, no code to touch — Assay reads it the way the public does.
- 02
Watch it scan
Assay fetches your app the way a browser does and checks it live, right in front of you — for exposed keys, an open database, and missing protections.
- 03
Get your report + fixes
Every issue is explained in plain language — with the exact prompt to paste back into your builder. Clean apps earn the hallmark.
Two apps, judged two ways.
A mark you can trust because it says exactly what was checked and what was found — not a green light that means nothing.
Safe to publish
No secret keys in the browser. Database locked down — rows are protected. Security headers in place. This app earned the hallmark.
Not safe to publish — yet
Critical: your database is open to the public. Anyone can read every customer’s name, email, and order.
Turn on row-level security for the
profiles and orders tables, and add
a policy so users see only their own
rows.Free to start. Fair as you grow.
Free
For checking your first app.
- 1 app
- 100 scans / month
- Plain-language report + paste-back fixes
- Watch 1 app — regressions on your dashboard
- Saved scan history
Pro
RecommendedFor builders shipping every week.
- Unlimited apps
- 2,000 scans / month
- Continuous re-scans on every change
- Email alerts when a change breaks something
- Weekly watch digest
- Priority scan queue
Team
For teams that ship together.
- Everything in Pro
- 10,000 scans / month
- Up to 10 seats
- Shared apps across the team
- Audit log
Don’t ship it on a hunch.
Free to find out. Paste your app’s link and get your first report — issues in plain language, with the exact fix — in about a minute.