/ for apps built with Lovable, Bolt, Replit, Base44, v0, Cursor and Claude Code
Is your AI-built app actually working right now?
The page can load while the database behind it is paused, the checkout is still in test mode, or a secret key sits in the code every visitor downloads. Your users usually find out first.
Paste your app's address. We check it from the outside, the way your users see it.
Free, no sign-up. Takes about 10–20 seconds.
/ what we check
Is it actually up?
We load your app the way a visitor does, and recognise your host's own 'paused', 'suspended' and 'unavailable' pages.
Is the database behind it awake?
A paused Supabase project behind a working page is the most common silent breakage: the site loads, nothing saves.
Can people actually pay you?
A Stripe TEST key or a test payment link on the address customers buy from means every real card is declined.
Is a secret key showing?
We look for keys that must never reach a browser: Supabase service_role, Stripe secret keys, OpenAI, Anthropic or AWS keys. We report the kind, never the key.
How does sign-in look from outside?
Which sign-in methods are switched on, and whether anyone can create accounts without confirming an email.
Will it expire?
On your own domain only: we warn if the HTTPS certificate is invalid or expires within 14 days, or the domain registration expires within 30 days (where the registry publishes a date).
/ what we never do
- — We never log in, guess passwords, or try to break anything.
- — We never read your data. The only backend requests go to two public Supabase endpoints: its health check and its sign-in settings.
- — We never store your app's code or any key we see. A report link runs the check again (a result is reused for up to 5 minutes).
- — We count checks with a scrambled code instead of your app's address, so we can tell how many different apps were checked.
/ questions
- Doesn't my platform already monitor my app?
- Some do, partly. But your platform is also the party that pauses projects when credits run out, applies limits and suspends accounts. An independent check sees your app the way your users do. If you build with Cursor or Claude Code and host on Vercel or Netlify, nothing is watching by default.
- Is this a security audit?
- No. It is a quick look from the outside at the things that most often break live AI-built apps or quietly cost money. It cannot see your code, your database rules or your logic, so 'looks OK' is not a guarantee.
- Why would my database be paused if my app loads?
- Your page and your backend are hosted separately. Free Supabase projects pause after inactivity, and some builders pause the backend when credits run out, while the page itself keeps loading.