import { createClient } from "@supabase/supabase-js";
import { useEffect, useState } from "react";
 
const supabase = createClient(url, anonKey);
 
export function Orders() {
  const [rows, setRows] = useState([]);
  const [loading, setLoading] = useState(true);
 
  useEffect(() => {
    let cancelled = false;
 
    async function load() {
      const { data, error } = await supabase
        .from("orders")
        .select("id, total, created_at")
        .order("created_at", { ascending: false });
 
      if (error) {
        console.error("failed to load orders", error);
        return;
      }
 
      if (!cancelled) {
        setRows(data ?? []);
        setLoading(false);
      }
    }
 
    load();
    return () => {
      cancelled = true;
    };
  }, []);
 
  if (loading) return <Spinner />;
 
  return (
    <ul className="orders">
      {rows.map((row) => (
        <li key={row.id}>
          <span>{formatMoney(row.total)}</span>
          <time>{formatDate(row.created_at)}</time>
        </li>
      ))}
    </ul>
  );
}
 
async function saveSettings(next) {
  const response = await fetch("/api/settings", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(next),
  });
 
  if (!response.ok) throw new Error(await response.text());
  return response.json();
}
 

import { createClient } from "@supabase/supabase-js";
import { useEffect, useState } from "react";
 
const supabase = createClient(url, anonKey);
 
export function Orders() {
  const [rows, setRows] = useState([]);
  const [loading, setLoading] = useState(true);
 
  useEffect(() => {
    let cancelled = false;
 
    async function load() {
      const { data, error } = await supabase
        .from("orders")
        .select("id, total, created_at")
        .order("created_at", { ascending: false });
 
      if (error) {
        console.error("failed to load orders", error);
        return;
      }
 
      if (!cancelled) {
        setRows(data ?? []);
        setLoading(false);
      }
    }
 
    load();
    return () => {
      cancelled = true;
    };
  }, []);
 
  if (loading) return <Spinner />;
 
  return (
    <ul className="orders">
      {rows.map((row) => (
        <li key={row.id}>
          <span>{formatMoney(row.total)}</span>
          <time>{formatDate(row.created_at)}</time>
        </li>
      ))}
    </ul>
  );
}
 
async function saveSettings(next) {
  const response = await fetch("/api/settings", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(next),
  });
 
  if (!response.ok) throw new Error(await response.text());
  return response.json();
}
 

import { createClient } from "@supabase/supabase-js";
import { useEffect, useState } from "react";
 
const supabase = createClient(url, anonKey);
 
export function Orders() {
  const [rows, setRows] = useState([]);
  const [loading, setLoading] = useState(true);
 
  useEffect(() => {
    let cancelled = false;
 
    async function load() {
      const { data, error } = await supabase
        .from("orders")
        .select("id, total, created_at")
        .order("created_at", { ascending: false });
 
      if (error) {
        console.error("failed to load orders", error);
        return;
      }
 
      if (!cancelled) {
        setRows(data ?? []);
        setLoading(false);
      }
    }
 
    load();
    return () => {
      cancelled = true;
    };
  }, []);
 
  if (loading) return <Spinner />;
 
  return (
    <ul className="orders">
      {rows.map((row) => (
        <li key={row.id}>
          <span>{formatMoney(row.total)}</span>
          <time>{formatDate(row.created_at)}</time>
        </li>
      ))}
    </ul>
  );
}
 
async function saveSettings(next) {
  const response = await fetch("/api/settings", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(next),
  });
 
  if (!response.ok) throw new Error(await response.text());
  return response.json();
}
 

import { createClient } from "@supabase/supabase-js";
import { useEffect, useState } from "react";
 
const supabase = createClient(url, anonKey);
 
export function Orders() {
  const [rows, setRows] = useState([]);
  const [loading, setLoading] = useState(true);
 
  useEffect(() => {
    let cancelled = false;
 
    async function load() {
      const { data, error } = await supabase
        .from("orders")
        .select("id, total, created_at")
        .order("created_at", { ascending: false });
 
      if (error) {
        console.error("failed to load orders", error);
        return;
      }
 
      if (!cancelled) {
        setRows(data ?? []);
        setLoading(false);
      }
    }
 
    load();
    return () => {
      cancelled = true;
    };
  }, []);
 
  if (loading) return <Spinner />;
 
  return (
    <ul className="orders">
      {rows.map((row) => (
        <li key={row.id}>
          <span>{formatMoney(row.total)}</span>
          <time>{formatDate(row.created_at)}</time>
        </li>
      ))}
    </ul>
  );
}
 
async function saveSettings(next) {
  const response = await fetch("/api/settings", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(next),
  });
 
  if (!response.ok) throw new Error(await response.text());
  return response.json();
}
 

Exhibit A · a live app, found in 4 seconds

const supabase = createClient(

"https://xyzcompany.supabase.co",

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…"

)

service_role key — full database access, no login required

Everyone who opened your app got this.

We open your app the way a visitor does and show you what they can take — with the evidence, and the fix for your stack. First scan is free.

No card · We break nothing — we only read what any visitor sees

RecognisesLovableBoltv0ReplitCursorand any other website

Case files

AI wrote your code. Who checked it?

Not a scare story — three documented cases. Bots crawl new sites within hours of them going live, and they look for exactly this.

170+

apps exposed by one flaw

CVE-2025-48757: row-level security left off, so anyone could read other people’s records.

NVD ↗

18,000

users leaked from one app

Names, emails and API keys readable by any visitor — no login, no exploit needed.

The Register ↗

45%

of AI-written code has flaws

Measured across 100+ language models on standard security tasks — not a survey.

Veracode ↗

Every one of these is visible from the outside — which means you can check for it in a minute. Check your app →

How it works

Three steps, one minute

01
Paste your link
No signup, no access to your code or hosting. Just the address anyone can open.
02
We look, we don’t touch
A real browser loads your app like a visitor: console, network, rendered page, speed.
03
Get the fix, not a lecture
Each finding comes with proof and a prompt you can paste straight back into your builder.

What you get

A real report, not a checklist

This is an actual scan of a demo app — grade, findings in plain words, and the measurements behind them.

out of 100

Critical: 1
High: 1
Medium: 2
Passed: 14

Critical

A full-access key reached the browser

Anyone opening your page can read and change every row in your database.

High

Any website can read your API responses

Your API allows requests from any origin, so another site can pull your data through a visitor.

Medium

Your app throws errors in the visitor’s browser

Part of the page silently stops working — the visitor sees an empty screen, you see nothing.

Fix prompt · paste into your builderCopy

Move the service key out of the client bundle.
Keep it server-side only, expose a narrow API
instead, and rotate the leaked key.

Not only security

A full check-up, like at the doctor

Security is the heart, but we check everything a visitor and a search engine meet — 30 checks across eight areas, one run.

Leaks

Keys and tokens that reached the browser or the repository

Access

Whether one user can reach another user’s records

Runtime

Errors thrown at visitors, broken images, failed requests

Speed

Core Web Vitals measured on a throttled connection

Search

Whether Google can index you and has something to show

Delivery

Compression, caching, certificate and its expiry

Dependencies

Libraries with publicly known vulnerabilities

Data storage

Publicly readable tables and open file storage

Is this safe?

We are a very attentive visitor

Fair question — we are asking you to hand a link to a tool you just met. So here is exactly what happens.

We do not break in
No logging in, no password guessing, no load testing. We read what your app returns to anyone.
Your data is not stored
The page, the bundles and the traffic live in memory for the length of the scan. What is saved is counts and a masked sample.
We never sell lists of vulnerable sites
Your results are private by default. That is the whole business — not a side channel.
We say what we cannot see
From the outside we do not see logic errors inside your code. The report lists what was skipped and why.

Your turn

What is in your bundle?

Your app is public right now. The first scan is free, and it takes a minute.

No card · Nothing stored after the scan