Free to check. A few dollars a month to keep it checked.
The scan is free. Pro fixes what it finds, and keeps watching.
Free
For a look right now.
$0
- Sixteen read-only checks, including Supabase Row Level Security, Firebase rules, debug pages, and API routes that answer without a login
- Up to ten pages and thirty scripts per scan, lazily loaded chunks included
- A shareable report page and a README badge
- Every finding with a why, in plain English
Pro
For apps with real users.
$19 / month
- The fix for every finding: in plain English, as the prompt to paste into the tool that built your app, and as the code for your host
- Monitor up to five apps
- Weekly re-scans, and an alert only when something new is wrong
- After every scan, what got fixed and what is new since the last one
- Code checks on your connected GitHub repos: committed secrets, missing RLS, dependencies with known vulnerabilities, queries built from strings
- A pull request that fixes what a file can fix: headers in your hosting config, the RLS migration, a committed .env removed
- Uptime and error alerts
- Help by email from the person who built it
Agency
For studios shipping client apps.
$49 / month
- Monitor up to twenty-five apps
- Everything in Pro, across every client site, on one dashboard
- A report link to send each client after every scan
- Priority help by email
Questions people ask
- Is it safe to run on a live app?
- Yes. Every check is read-only and makes the same requests a browser makes. Nothing is written, no passwords are guessed, no user records are read. The Supabase check asks for a row count and nothing else. About the scanner.
- How does the billing work?
- Monthly, in US dollars, through Polar, which is the merchant of record: the seller on your receipt, and the one responsible for VAT and sales tax. Your card details are typed on Polar's own page and never reach us. Change your card or cancel any time from the customer portal, linked on your dashboard. Cancel and the plan runs to the end of the period you have paid for, then stops.
- Can I try it without paying?
- The scan is free and stays free, as many apps as you like: every finding, what it exposes, and why it matters, in plain English. Pro is the fix for each one (the prompt to paste into the tool that built your app, the code for your host, and the pull request that applies it), and the watching afterwards.
- What do you store?
- Scan results: the findings, grades, and the addresses you asked us to check. Never your users' data, never a secret's value (findings show names and redacted prefixes only). Remove an app and its history goes with it.
- Which tools does it understand?
- Anything that ships a web app, with special attention to what Lovable, Bolt, Replit, Cursor, and v0 produce: Supabase and Firebase backends, Vite and Next.js bundles, keys that end up in the browser.