Is your AI-built app actually secure?
Paste your app or website link and get a clear A–F safety grade in about 20 seconds. No install, no jargon and we never touch your data.
Free · No signup · Read-only outside check · By scanning you agree to our Terms of Service and Privacy Policy.
Is the scan safe for my app?
Yes. We only look at what is already publicly visible from the outside, like checking whether your front door is locked without ever stepping inside.
You confirm the app is yours before we start, and we keep a record of that. A scan looks like one ordinary visitor arriving on your site.
What does the A–F grade mean?
“A” means we found nothing risky. “F” means something serious is exposed right now. You start at 100, and every finding costs points.
Then one rule sits on top of the arithmetic. One critical finding caps you at D, two cap you at F, and a single high finding caps you at C. A tidy app with one open database cannot come out looking fine.
Every scan comes with a shareable badge carrying this card. Post your A, or quietly fix that D before anyone sees it. Either way, your users can see you take their data seriously.
Scan to get your badge
We tell you what you got right, too
Two keys can look almost identical in the same file. One is how your app is supposed to work. The other hands over your whole database. Most free scanners flag both and let you sort it out.
Your Supabase anon key is visible in your code
It belongs there. Your app cannot reach its database without it. Your data is protected by the rules behind that key, which we check separately.
eyJhbGciOiJIUzI1NiIs… "role": "anon"A service_role key is sitting in the same bundle
This one ignores every rule you set. Anyone who opens your app can read, change or delete everything. Rotate it now, then move it to your server.
eyJhbGciOiJIUzI1NiIs… "role": "service_role"We decode the token and read the role written inside it, then say so in words. No guessing from the file name, and no wall of red over the key your app cannot run without.
One deploy can quietly flip it.
A grade is a photograph. True the second you take it, and out of date the moment you ship. Nobody opens a database on purpose, and nothing tells you when it happens.
A rule switched off to fix a bug
The page stopped loading, the model suggested disabling row-level security, and it worked. It is still off.
A key that moved to the wrong side
A server key gets pasted into the front end so a feature ships tonight. It ships in the bundle too.
A bucket opened for one upload
Made public to test an avatar, never made private again. Everything in it is now listable.
Introducing Reeve Monitor
We keep watching your app's health, day and night.
The full scan, every hour
All nine checks, re-run on your live app while you sleep.
720 checks a month
Uptime monitoring
We knock, if an app or website is down, you know within minutes.
Every 60 seconds
An email, only when it matters
What changed, what it means, and the fix. Ready to paste.
Only when something changes
One price, everything you need
The full security check on a loop, plus uptime, plus a report you can forward. No setup beyond pasting your link.
Reeve Monitor
$12/mo
- The full security check, re-run every hour. 720 checks a month. You hear the day something changes.
- Uptime watched every 60 seconds. Down and back up, in plain words.
- Up to 3 apps or sites, watched side by side.
- Downtime and security alerts, the moment something needs you.
- Monthly plain-language report (PDF). What we watched and what we found.
Cancel anytime · your data stays yours
Monitor + backups + one-click restore. See plans →
How this free website security scanner compares
No brand names, because the category is what decides whether a tool can help you. There are two other kinds of free website security scanner, and they are good at different things.
| Reeve | Header and certificate checkers | Signup-gated AI-app scanners | |
|---|---|---|---|
| A grade without signing up | ReeveGrade, score and counts on screen in about 20 seconds. Email only for the detailed fixes. | Header and certificate checkers Usually yes, and usually instant. | Signup-gated AI-app scanners No. Account first, results after. |
| Knows which keys belong in a browser | ReeveA publishable key is marked correct. A secret key is critical. We read the role inside the token. | Header and certificate checkers They never look at your code at all. | Signup-gated AI-app scanners Often flags every key it finds, so you cannot tell which one matters. |
| Checks your database from outside | ReeveCounts the rows your rules should be hiding, and never reads one. | Header and certificate checkers No. Headers and TLS only. | Signup-gated AI-app scanners Sometimes, after you connect it to your account. |
| Written for a non-developer | ReevePlain language in seven languages, and a fix you can paste into your builder. | Header and certificate checkers Header names, cipher suites, and a letter grade of their own. | Signup-gated AI-app scanners A report written for the developer you may not have. |
| What the paid tier gives you | ReeveWatching: all nine checks every hour, uptime every 60 seconds, and a report you can forward. From $12 a month. | Header and certificate checkers Usually nothing to buy. It is a one-off look. | Signup-gated AI-app scanners More scans and more seats. Still a scanner. |
A header checker is genuinely useful, and cheaper than free. We run that check too, as one of nine.
What we check, in plain language
Nine read-only checks that cover how most vibe-coded apps actually get burned.
Leaked secret keys
Is a paid-API or admin key visible in your app's code where anyone can copy it?
Unprotected database
Can strangers read your users' data because row-level security is off?
Exposed private files
Are files like .env or database dumps downloadable from your site?
Browser safety locks
Are the security headers that protect your visitors switched on?
Open storage buckets
Can anyone list or read the files your users uploaded?
Published source maps
Is your original source code readable by anyone who looks?
Open APIs & CORS
Do your API endpoints answer to strangers or any website that asks?
SSL certificate expiry
Is your HTTPS certificate valid and not about to lapse, or are visitors about to hit a scary browser warning?
Domain renewal
Is your domain name renewed in time, so your app doesn't suddenly vanish and the name can't be snatched?
When something is set up correctly, like a public key that's supposed to be public, we say so too, instead of scaring you with a false alarm.
One page a month, written for you and not for a developer
On the first of every month a PDF lands in your inbox: your grade and how it moved, how much of the month your app was up, how many checks we ran, what changed, and anything still waiting on you.
It is the thing to forward when a client asks whether the site they paid for is being looked after. Keep them and you have a year of evidence that somebody was watching.
- English
- Deutsch
- Français
- Español
- Português
- Italiano
- Українська
REEVE MONITORMONTHLY REPORTJuly 2026
July was quiet, and here is the proof. Your app answered every check but four, and the one thing that changed is on page 2.
99.97%
Up and answering
720
Security checks run
2
Changes caught
1
Still waiting for you
What Monitor does not do
It watches and it tells you. It does not back your data up, it cannot put your app back after a bad change, and it will not apply a fix for you. Those three are Reeve Care, which holds verified copies of your database outside your Supabase account and restores them in one click.
About Reeve Monitor
What happens when Monitor finds something?
You get an email, usually within the hour of it happening. It says what changed, what it means for your users, and how serious it is, in the same plain language as your first report. Underneath is the fix, written for the builder you used, ready to paste.
If your app stops answering altogether, that email goes out in minutes rather than hours, and a second one arrives when it comes back.
Does it fix the problems?
No, and we would rather say so on the page than in a support reply. Monitor watches, explains and hands you the repair. You are the one who presses the button.
If you would rather it was us, a bigger plan adds backups, one-click restore, and a person who applies the fix for you.
What is in the monthly report?
One PDF: your grade and how it moved, how much of the month your app was up and answering, how many checks we ran, every change we caught, and anything still open. It arrives in your own language.
It is meant to be forwarded. Nothing in it needs explaining to the person you send it to.
Will the hourly checks slow my app down?
No. An hourly check is a handful of read-only requests from outside, which is less traffic than one person browsing your site for a minute. The uptime ping is a single request that asks whether the door opens.
Nothing logs in, nothing is written, and nothing your users do is touched.
Do I need a credit card to start the free trial?
Yes. The card is taken when you start, so watching carries on without a second signup, and nothing is charged during the free days.
We email you before the first payment, naming the amount and the date. Cancel before then and you pay nothing at all.
Can I cancel anytime?
Yes, from your dashboard, in two clicks. Watching stops at the end of the period you have already paid for, and the trial ends on its own if you do nothing.
No exit fee, no lock-in, and nothing of yours is held back.
Is a free scan enough, or do I need a pentest?
This is an automated external check, not a full audit. It catches the most common ways vibe-coded apps get burned, and a clean result is not a guarantee of safety.
A penetration test is a person spending days on your app, and if you handle payments or health records you will want one eventually. Most apps we scan have not yet closed the doors that are visible from the street, which is what this is for.
I built with Lovable, Bolt, v0 or Replit. Is that safe?
The builder is rarely the problem. All of them can produce a locked-down app and all of them can produce an open one, because the risky parts are settings you or the model chose: whether row-level security is on, where a key ended up, whether a bucket is public.
We keep a plain-language guide for each of them, Is my app safe?, covering what that builder gets right and what it leaves to you. The scan answers the same question about your specific app in 20 seconds.
Can I check some of this myself, without a tool?
Yes, and we wrote it down rather than hiding it behind the scan. The 10-minute security checklist walks you through the handful of things that cause most of the damage (where your keys are, whether row-level security is on, whether a bucket is public) in your builder's own settings, with nothing to install.
Do it by hand first if you would rather. The scan is there for the parts you cannot see from the inside.
Where do the numbers on this page come from?
From our own sweep: 30,998 vibe-coded apps that were live on the internet in August 2026, each put through the same nine checks this page offers you. Not a survey and not somebody else's dataset.
The method, the sample, what we could not measure and every figure behind the receipt are in the full research report.
Get the grade. Then stop thinking about it.
The scan is free and always will be. The watching is $12 a month, and the first week is on us.