One agent checks security holes, broken flows, performance, SEO and UX — then emails you a GO / NO-GO report with copy-paste fix prompts for Cursor and Lovable.
Paste your URL. We run the scanners and an agent that actually uses the app. You get a ranked report — not a raw Lighthouse dump.
Confirm you own the app. Optional: builder used (Lovable / Bolt / Cursor) and two test accounts for Pro.
Secrets in JS, exposed .env/.git, headers, broken flows, Lighthouse, SEO, Supabase/Firebase RLS probe, and (on Pro) a two-account IDOR test.
Plain-English findings with evidence and a copy-paste fix prompt for Cursor, Lovable or Bolt. One free re-check within 14 days on Launch Check.
Verdict, score, screenshots, and every finding with a fix prompt. Open the sample mini-scan · full report.
Broader than a security-only scan, sharper than a generic Lighthouse score.
Keys in JS bundles, .env/.git/source maps, headers, cookies, CORS, Supabase service_role, missing RLS.
404 nav links, console errors, failed API calls. Pro: sign-up, log-in, and a two-account data-isolation test.
Lighthouse, huge images, slow resources, page weight, render-blocking scripts.
Title, meta description, Open Graph, viewport, canonical, robots.txt, sitemap, favicon.
Labels, alt text, button names, colour contrast, plus a UX review of your screenshots.
Every finding ships with a copy-paste prompt tuned for Cursor, Lovable and Bolt.
Supabase stops auto-granting new public tables to anon/authenticated. The quick fix people reach for — broad GRANTs — can undo RLS. We probe whether your anon key can still read tables it shouldn't.
Free mini-scan catches exposed keys and open tables on the outside. Launch Check / Pro go deeper.
No subscription for the core check. Pay once, get the report and a free re-check.
Lead magnet — see the top issues fast.
$29 for the first 50 customers
When you need the logged-in test.
Need us to open a PR for the criticals? Request a Fix-It Pack from $149 — human-reviewed before delivery.
Paste the live URL of an app you own (or have written permission to test). No repo access needed.
Request-only for now — we'll follow up with a quote. A human reviews before anything is delivered.
No. It's an automated, outside-in launch-readiness check (plus an authenticated flow test on Pro). We don't run destructive exploits. You still need a real pentest for high-risk apps.
No. URL is enough. Pro can optionally look at a public repo. We never ask for your GitHub password.
Don't scan it. We require an ownership confirmation checkbox, rate-limit free scans, and block obvious third-party / private targets unless you've confirmed ownership.
Most reports land in under an hour. The free mini-scan is usually a few minutes.
The first 50 Launch Check customers pay $29 instead of $39. Same report, one free re-check within 14 days.
If we fail to deliver a report for a paid order, you get a full refund. Otherwise there are no refunds after a report is delivered, except where required by law. See the Terms.
Vibe Greenlight