LatchDog

For apps built with Lovable, Bolt, Cursor, Replit & v0

Your AI built the app.
LatchDog checks the locks.

Weekly and per-deploy security checks for apps built with Lovable, Bolt, Cursor, Replit and v0. Find leaked API keys, Supabase tables anyone can read, and missing security headers, with a fix prompt you paste straight into your AI tool.

Free, read-only public check: no sign-up, no card. Headers and HTTPS only. Deep scan (leaked keys, open Supabase tables, .env/.git) after you verify you own the domain.

deep scanyourapp.example.comExample report
41/ 100
Grade D
1 critical · 1 high · 2 medium
  • critical
    Supabase service_role key in your JS bundle
    /assets/index-3f9a2c.js

    Remove the service_role key from all frontend code and browser-exposed env vars (VITE_*, NEXT_PUBLIC_*), move privileged calls into a server function, then rotate the key…

  • high
    Supabase table or view profiles is readable with the public anon key
    Supabase REST, 1-row check, no data stored
  • medium
    No Content-Security-Policy header
    https://yourapp.example.com/
  • medium
    Production source maps are public
    /assets/index-3f9a2c.js.map

Illustration of what a LatchDog report looks like. Not a real customer's app.

🔑 Leaked secrets

Supabase service_role, OpenAI, Anthropic and Stripe secret keys hiding in your JS bundles and source maps.

🗄️ Open Supabase tables

Up to 15 tables or views your code names with .from() that anyone can read with your public anon key. One LIMIT 1 check each, after you verify ownership, no data stored.

🧱 Headers & HTTPS

CSP, HSTS, clickjacking protection, nosniff, referrer policy, HTTPS redirects.

📂 Exposed files

Public .env files, .git folders and production source maps.

How it works

  1. Paste your URL for a free public check.
  2. Verify you own the domain (DNS TXT, meta tag, or a file).
  3. Get a deep scan with a severity and a copy-paste fix prompt for every issue.
  4. LatchDog re-scans weekly (and after every deploy on Pro), and emails you only what changed.

Why AI-built apps need this

AI coding tools ship fast and change a lot of code every time you prompt them. A fix you made last week can quietly come undone in the next deploy. LatchDog watches from the outside, the way an attacker would, so you hear about it first.

One vibe-code security fix a day

AI wrote your app fast. These emails help you lock it down. Each one covers a single, specific issue we see in AI-built apps (open database rules, leaked API keys, missing auth checks) and how to fix it in a few minutes.

One short email a day. Free. Unsubscribe in one click from any email. We'll never sell or share your address. Privacy policy

See pricing · Exactly what we send and store