You shipped it with AI. Here’s what the AI didn’t check.
AI builders get you to production fast and skip the boring parts: keys pasted into frontend code, database tables anyone can read, missing security headers, a page search engines can barely understand. Paste your URL and get a prioritised list — with fixes your AI can apply.
Free, no sign-up. The basic check makes only the requests an ordinary browser would.
What we usually find on AI-built sites
- CriticalFree check
A secret key in your public JavaScript
A Supabase service_role or secret key, an OpenAI, Anthropic or Stripe secret — shipped to every visitor’s browser. Anyone can copy it from the bundle and spend your money or read your data.
- CriticalPro
Database tables anyone can read
If Row Level Security is off, your Supabase tables answer anyone holding the public key. After you verify the domain we count how many rows are readable — without ever reading their contents.
- MediumFree check
No Content-Security-Policy or HSTS
Without them a single injected script can steal sessions, and the first visit can be downgraded to plain HTTP. Usually a few lines of host configuration.
- MediumFree check
Trackers without a consent tool, no privacy policy
Analytics or ad trackers with no recognised consent tool on the page, and no link to a privacy policy or terms. A problem under GDPR — and the first thing payment providers look at.
- LowFree check
Search engines get an empty shell
Missing title, description, sitemap or social preview — checked both in the raw HTML and in the page rendered by a real browser.
Fixes come as a prompt for your AI
You don’t need to know what a CSP header is. Copy the prompt from your report into Lovable, Bolt, Cursor or Claude Code — it lists the findings, where they are and how to verify the fix.
Fix these issues on shop.example. Locate each one before changing anything; make the smallest change that fixes it. 1. A Supabase service_role key is in the public JavaScript bundle (assets/index-3f9c.js). Move every call that needs it to a server function, rotate the key in Supabase, and use only the anon key in the browser. 2. No Content-Security-Policy header. Add one on the host; start with default-src 'self' and allow only the origins the page really loads. When done, re-check: https://scanyoursite.app/en?check=shop.example
Your next deploy will break something
AI tools rewrite whole files. A key that was fixed comes back; a page gets noindex. With Pro we notice every new deploy, check it within minutes and write only when something new breaks — in Telegram, by email or to Slack and Discord.
See plansQuestions
Is it safe to scan my production site?
Yes. The free check makes only the requests an ordinary browser or search crawler makes: the page, its scripts, robots.txt, the sitemap, DNS and the certificate. It never logs in, submits forms or guesses passwords.
Which builders does it work with?
Any site with a public URL: Lovable, Bolt, Cursor, v0, Replit, Windsurf, Base44, or code you wrote yourself. We look at the live site from the outside, so nothing needs to be installed.
Do I need to understand the findings?
No. Each finding says what it means for your users or your bill, and the report gives you a prompt to paste into your AI coding tool.
What does it cost?
The check is free. Monitoring starts at $19 / €19 a month for three sites, with daily checks, uptime every five minutes and a check after every deploy.
Paste your URL. Get the list in about a minute.
Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.
Free, no sign-up. The basic check makes only the requests an ordinary browser would.