FAQ
What is LatchDog?
LatchDog is a security and health monitor for apps built with AI tools like Lovable, Bolt, Cursor, Replit and v0. It checks your live app from the outside for leaked secret keys, Supabase tables anyone can read, exposed .env and .git files, public source maps, missing security headers and HTTPS problems. Every finding comes with a fix prompt you paste into your AI coding tool.
What does the free scan check without signing up?
Only passive, public checks: it loads your homepage over HTTPS and HTTP and reads the response headers and TLS behavior (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HTTPS and HTTP-to-HTTPS redirect, insecure http:// scripts). It does not look for secrets, files, or database access. Anything deeper requires you to verify that you own the domain.
What does the deep scan check?
After you verify ownership: secret keys in your JavaScript bundles and source maps (Supabase service_role and secret keys, OpenAI, Anthropic, Stripe secret keys, AWS access key IDs, GitHub, Slack, SendGrid, Resend and other tokens, private keys), public source maps, downloadable .env and .git files, CORS that reflects any origin with credentials, and Supabase tables readable with your public anon key.
Is the scan safe? Will it change my data?
Scans are read-only. LatchDog only sends GET requests, never submits forms, never logs in, and never writes or deletes anything. For Supabase it sends one SELECT with LIMIT 1 per table using your public anon key and only records whether a row came back; row contents are discarded and never stored. Secret values are never stored; reports show a masked preview.
Why do I have to verify my app first?
So LatchDog never deep-scans a site its owner has not authorized. You can verify with a DNS TXT record, a meta tag, or a /.well-known/latchdog.txt file. Ownership is re-checked before every deep scan, and scans pause if the record disappears.
How often does LatchDog scan?
Starter and Pro scan every verified app weekly. Pro also scans after every deploy through a deploy webhook you add to your host or CI. The free plan includes one public check at any time and one deep scan after verification.
How will I be alerted?
By email, and only when something changed since the last scan: new issues, issues that got worse, and issues you fixed. No change, no email.
What is a fix prompt?
A ready-made instruction you paste into Lovable, Bolt, Cursor or a similar tool. It describes the problem and the safe fix, for example enabling Row Level Security on a table and adding an owner-only policy. Always review what the AI changes before you publish.
Is my Supabase anon key a leak?
No. The anon/publishable key is designed to be public; your RLS policies protect the data. LatchDog does not report the anon key as a leak. It reports service_role and sb_secret_ keys, which bypass RLS.
How much does it cost?
Your first scan is free, no card needed. Starter is $19/month for 1 app with weekly scans. Pro is $39/month for up to 5 apps with weekly scans plus per-deploy checks.
Is LatchDog a penetration test?
No. LatchDog is an automated, outside-in check for common mistakes in AI-built apps. It is not a penetration test, code review, or compliance certification, and it cannot guarantee an app is secure.