Who builds this
Assay is one person. Not a team, not a company with a security practice behind it — me, writing the scanner, the copy, and this sentence.
It started from something that kept happening. People were shipping real apps — with real users and real payment details in them — built in an afternoon with Lovable or Bolt or Replit. Good apps, mostly. But the database was wide open, or the Stripe key was sitting in the JavaScript, and nobody had told them, because the only thing that had ever looked at that code was the same AI that wrote it.
That’s the whole argument, and it’s why Assay is a separate thing rather than a feature inside a builder: the tool that wrote your code can’t be the one that vouches for it. Not because it’s dishonest — because it’s grading its own work, and it will grade generously.
What Assay actually does
It fetches your live app from the outside, with no credentials, and runs five checks. That’s the entire product.
- Exposed keys
- Reads your app the way a browser does and searches the shipped JavaScript for credentials that shouldn't be there — Stripe secret keys, service-role keys, API tokens.
- An open database
- If your app talks to Supabase or Firebase, Assay asks that database for data using nothing but the public key in your bundle. If it answers, anyone can ask the same question.
- Public file storage
- Checks whether the buckets your app uploads to will hand their contents to a stranger.
- Files that shouldn't be served
- A handful of exact paths — .env, .env.production, .git — that get deployed by accident and read by scanners within hours.
- Missing browser protections
- Response headers: Content-Security-Policy, HSTS, clickjacking and MIME-sniffing protection.
Every check is read-only. Assay never sends an exploit, never writes or changes anything, and never stores what it reads — when it proves a database is readable, the values are masked before they ever reach your screen and are never written down. It only runs against apps you tell it you own.
What Assay doesn’t do
This section is here on purpose. A security tool that won’t name its own gaps is asking you to trust it more than it has earned.
- It is not a penetration test. A pentest is a person, with time and creativity, trying to break your specific app. Assay is a machine looking for a fixed list of known mistakes. The two are not substitutes, and anyone who tells you otherwise is selling something.
- It doesn't look behind a login. Everything Assay checks is what a stranger with your URL can reach. Whatever your app does after someone signs in is currently untested.
- It doesn't understand your business logic. If your pricing can be manipulated, or one customer can see another's invoice through a legitimate-looking request, Assay will not catch that.
- It doesn't audit your source code. It only sees what you shipped to the browser.
- A clean result is not a guarantee. It means the specific checks above found nothing. That's genuinely worth knowing — most of the apps that fail, fail on exactly these things — but it is a floor, not a ceiling.
About the hallmark
The name comes from assaying — the old test for whether a bar of metal is the purity it claims to be. An assay office doesn’t make the silver and doesn’t sell it. It just tests it, independently, and strikes a small mark if it passes.
Assay’s mark means one specific thing: on this date, these checks were run against this app from the outside, and none of them found anything. It is not a certification, it doesn’t mean an expert reviewed your app, and it expires — an app that was clean last month can ship a bad deploy tomorrow. That’s the honest size of the claim, and we won’t stretch it.
Where it is right now
Early. Assay is new, the user count is small, and the list of checks is deliberately short — I’d rather five checks be genuinely good than thirty be roughly right. Breadth is the easy part and it’s where most scanners go to become useless.
If you run a scan and it misses something, or flags something that isn’t real, I want to know — that’s not a support ticket to me, it’s the most useful thing you can send. It reaches me directly at hello@assaysecurity.com.
Want to see it work? Scan your app →