Reeve For apps & sites built with Lovable, Bolt, v0, Cursor & friends
Is your vibe-coded app/website leaking secrets right now?
Paste your app or website link and get a clear A–F safety grade in about 20 seconds. No install, no jargon and we never touch your data.
Free · No signup · Read-only outside check · By scanning you agree to our Terms of Service and Privacy Policy.
How Reeve works
Three steps from “I hope it's fine” to “I know it's covered.”
Scan
Paste your link. We check your app from the outside, the same way an attacker would look at it, but read-only.
Understand
You get an A–F grade and plain-language findings: what's wrong, why it matters, and exactly how to fix it.
Relax
Reeve keeps watching: monitoring, backups and alerts, with every fix explained in words you already use.
A scan tells you what's wrong. Reeve Care takes it off your plate.
You didn't sign up to become a security engineer. Reeve Care watches your app, backs it up, and shows you exactly what to fix.
We watch it around the clock
Most weeks you never open the Supabase console. Reeve checks your app every day and tells you the moment something changes.
Backups from the first minute
One bad prompt can wipe real data. We keep verified copies of your database and your users' files, on your plan's schedule.
One click puts your app back
A bad change or a bad day can't wipe you out: restore any copy in a single tap, and we snapshot “now” first.
Fixes, in plain English
When something breaks we tell you what it means and hand you the fix, written for your builder, ready to paste.
The undo button for your app
Your first copy happens the moment you connect: your database, and the photos and files your users uploaded. If a bad change ever wipes something, you restore it in one click. We snapshot “now” first, so the undo itself can be undone.
Automated protection, not a guarantee. Backups and monitoring reduce risk. They can't remove it entirely.
A bad deploy just wiped your users' data. Now what?
- Free-tier Supabase keeps no backups, so on a free plan there may be nothing left to restore from at all.
- Idle Supabase projects are paused after about a week of low activity, and platform support queues run for days.
- Reeve's copy is off-platform: it survives your account being paused, deleted, or compromised.
While you build, Reeve watches everything.
Everything Reeve keeps doing once you're set up. Tap any card for the detail.
You go from “I hope it's fine” to “I know it's covered.”
What changed the week they stopped worrying.
I scanned my app and found that 2 Supabase tables were readable to anyone. I was shocked. Now after every deployment I check my app with Reeve Care scan tools. 5 stars.
I vibe-coded my first app in three weeks. Got a successful launch using my socials and 72 paying customers. But then one stupid prompt erased the payments table. Found Reeve with daily Supabase backups, and now I sleep peacefully.
I’ve been helping manage and deploy vibe-coded apps for a year now. I prepare them for their first production launch and support them afterward. Currently using Reeve Care Max for 8 apps.
scanned my app with a free scanner but still had no idea where i was leaking secrets. reeve support found an exposed key + source map for me. btw i store my backups here now
Switched from Supabase paid plan because they only keep data for 7 days. Reeve stores both of my apps for 45 days. The one-click restore button with options is solid and I already used it once and it worked.
I’ve been in the design business for 6 years. Decided to build my first app with Lovable. Found this free scanner that helped me discover what was wrong + some tips. Nothing major, just 3 issues.
Their restore button is pure magic. Saved me a whole day of digging through the Supabase console. I only needed to restore specific tables, not the full database and Reeve lets you do that with one tap.
Got a B grade from the scanner. Then I read about backups on this website and never thought I’d actually need them. You can download any backup to your PC anytime. Uptime monitoring is useful too.
Saved my day. Successfully restored a DB column from 9 days ago. Thanks
I didn’t take backups seriously until a database disaster happened. The project stopped opening. After a painful half day I was able to find help. Now I use Reeve Care for backups and app reports
Choose your level of care
The scan is free forever. Keeping it that way is a subscription. Switch or cancel anytime.
Care
$49$39/mo
Sale ends Sep 30
Everything you need to sleep well.
- 1 app or site watched
- Daily backups, 30 restore points kept
- Users' uploaded files included
- 10 GB of backup storage
- One-click restore, with a safety copy first
- Security checks every hour · uptime every 60 s
- Security fixes as prompts, tailored to your builder
- Monthly plain-language report (PDF)
7-day free trial
Care Pro
MOST POPULAR$79/mo
For more apps, and tighter safety nets.
- 5 apps or sites watched
- Backups every 12 hours, 90 restore points
- 50 GB of backup storage
- Everything in Care
- Public status page for your users
- “Can people find you?” visibility check
- Priority chat, front of the queue
7-day free trial
Care Max
$139/mo
The tightest safety net we offer.
- 10 apps or sites watched
- Backups every 6 hours, 90 restore points
- 200 GB of backup storage
- Security checks every 15 min · uptime every 15 s
- Everything in Care Pro
- Status page on your own domain
- Priority support, including a hand applying a fix
7-day free trial
Reeve Monitor · just want watching?Uptime every 60 s · hourly re-checks · up to 3 apps · no backupsWhat's included
- The full security check, re-run every hour. 720 checks a month. You hear the day something changes.
- Uptime watched every 60 seconds. Down and back up, in plain words.
- Up to 3 apps or sites, watched side by side.
- Downtime and security alerts, the moment something needs you.
- Monthly plain-language report (PDF). What we watched and what we found.
No backups or restore here. Monitor watches; it can't put your app back. That's Care.
$12/mo
Get MonitorBuilding for clients? Care Studio: white-label reports, one invoice, unlimited apps.
Let's talk →7-day free trial · cancel anytime · your data stays yours, encrypted, off-platform, EU-resident.
Everything in one calm place.
This is your app under Reeve Care. Control every part of your protection from one screen.
What we check, in plain language
Nine read-only checks that cover how most vibe-coded apps actually get burned.
All nine run on any live URL you paste into the free website security scanner. No account, no install.
Leaked secret keys
Is a paid-API or admin key visible in your app's code where anyone can copy it?
Unprotected database
Can strangers read your users' data because row-level security is off?
Exposed private files
Are files like .env or database dumps downloadable from your site?
Browser safety locks
Are the security headers that protect your visitors switched on?
Open storage buckets
Can anyone list or read the files your users uploaded?
Published source maps
Is your original source code readable by anyone who looks?
Open APIs & CORS
Do your API endpoints answer to strangers or any website that asks?
SSL certificate expiry
Is your HTTPS certificate valid and not about to lapse, or are visitors about to hit a scary browser warning?
Domain renewal
Is your domain name renewed in time, so your app doesn't suddenly vanish and the name can't be snatched?
When something is set up correctly, like a public key that's supposed to be public, we say so too, instead of scaring you with a false alarm.
Show off your grade
Every scan comes with a shareable badge. Post your A, or quietly fix that D before anyone sees it. Either way, your users can see you take their data seriously.
Scan to get your badgeFAQ
Is the scan safe for my app?
Yes. We only look at what's already publicly visible from the outside, like checking whether your front door is locked without ever stepping inside. We never log in, never change anything, and never download your users' data.
I built my app with Lovable / Bolt / v0 / Cursor. Will this work?
That's exactly who Reeve is for. We know how these builders structure apps (including which keys are supposed to be public), so what we flag is worth your time.
Do I need to install anything?
No. Paste your app's link, and that's it. The scan runs entirely from our side and takes about 20 seconds.
What does the grade mean?
A means we found nothing risky. F means something serious is exposed right now. Every finding comes with what it means and how to fix it, in plain language.
What happens to my email?
We send your report there, and occasionally news about Reeve. No spam, no selling your data, unsubscribe anytime.
Is this a full security audit?
No. It's an automated external check. It catches the most common ways vibe-coded apps get burned, but a clean result isn't a guarantee. For ongoing coverage, that's what Reeve Care is for.
About Reeve Care
Doesn't Supabase already back up my database?
Sometimes. It depends which plan you're on. The free plan includes no automatic backups at all; paid plans keep daily copies for a limited window, inside your Supabase account. Keep those. Reeve does a different job: your own backup history, stored outside your Supabase account, verified after every run, and a one-button restore. Supabase parks a spare key inside the house; we keep one across the street.
What keys do you hold, and what can they do?
For backups we hold a read-only database role that can't write or delete anything, encrypted per customer. Putting data back needs a full-power credential, which we ask for at the moment of each restore and is never stored. If you also want your uploaded files copied, that takes Supabase's secret key, because Supabase issues no read-only key for files. It's optional, we use it only for your files, and you can withdraw it in one click.
Where is my data stored, and is it encrypted?
Encrypted with AES-256-GCM using per-customer keys, stored off-platform on EU infrastructure. We're honest: it's encrypted and least-privilege, not “zero-knowledge”. We hold the key so we can restore for you.
Can a restore break my app?
We snapshot “now” first, confirm by email, and restore in one transaction, so an aborted restore leaves nothing half-written. The undo itself can be undone.
How is Care different from the free scan?
The scan is a one-time grade. Care watches your app, backs it up, and fixes things continuously, so you don't have to think about it.
What happens if I cancel?
You keep everything until the end of the period you've already paid for. After that we stop watching and backing up, but we keep your restore points for 30 days so you can still pull a copy. Then we delete them and remove your key from our vault. There's no lock-in and no exit fee. Your data is yours to take.