Free to check. A few dollars a month to keep it checked.
The scan tells you what your app left open today. Pro keeps looking every week, watches the code you push, and tells you the moment something new goes wrong.
Early access. Pro and Agency are being onboarded by hand and nothing is charged yet. Leave your email and you get an account as soon as one is ready; early members keep the early-access price when billing opens.
Free
For a look right now.
$0
- Fourteen read-only checks, including Supabase Row Level Security and Firebase rules
- Up to ten pages and thirty scripts per scan, lazily loaded chunks included
- A shareable report page and a README badge
- Every finding with a why and a fix in plain English
Scan an app
Pro
For apps with real users.
$19 / month
Early access
- Monitor up to five apps
- Weekly re-scans, and an alert only when something new is wrong
- Code checks on your connected GitHub repos: committed secrets and missing RLS, before they deploy
- Uptime and error alerts
- Help by email from the person who built it
Agency
For studios shipping client apps.
$49 / month
Early access
- Monitor up to twenty-five apps
- Everything in Pro, across every client site, on one dashboard
- A report link to send each client after every scan
- Priority help by email
Questions people ask
- Is it safe to run on a live app?
- Yes. Every check is read-only and makes the same requests a browser makes. Nothing is written, no passwords are guessed, no user records are read. The Supabase check asks for a row count and nothing else. About the scanner.
- What does early access mean?
- Billing is not switched on yet. We set accounts up by hand, you use Pro in full, and you get an email before anything is ever charged. Early members keep the early-access price.
- Can I just sign in and start today?
- Yes. Sign in with GitHub, add an app, and it is watched from that moment. The email form above is for people who want Pro or Agency reserved at this price.
- What do you store?
- Scan results: the findings, grades, and the addresses you asked us to check. Never your users' data, never a secret's value (findings show names and redacted prefixes only). Remove an app and its history goes with it.
- Which tools does it understand?
- Anything that ships a web app, with special attention to what Lovable, Bolt, Replit, Cursor, and v0 produce: Supabase and Firebase backends, Vite and Next.js bundles, keys that end up in the browser.