You built it with AI.
Let's make sure it's not leaking.
Send us the link to your live app. Within 24 hours you get a plain-English report of what's visible from the outside: leaked keys, open databases, exposed files. Each fix comes as a prompt you can paste straight into Cursor, Claude Code, Lovable or Bolt.
From $29 · report within 24 hours · we only look at the public side of apps you own
/admin loads for visitors who aren't signed in.env or .git folder exposedAI coders are fast. They're not always careful.
Coding tools will happily build what you ask for. They don't always stop to lock the doors. These are things builders regularly find in their own live apps, usually after someone else does:
Keys in the bundle
An OpenAI, Stripe or other secret key ends up in the frontend code, where anyone can open dev tools and copy it, then spend your credits.
Open databases
Supabase tables without row-level security, or Firebase rules left in test mode, so strangers can read (or change) your users' data.
Files that shouldn't be public
A .env file or .git folder deployed by accident, quietly handing out passwords and source code.
Admin pages anyone can open
"Admin only" checks that only run in the browser. Hide the button and the page still works for anyone who knows the URL.
Shaky sign-in
User roles kept in localStorage, password reset flows that say too much, and APIs that trust whatever the browser sends them.
Missing safety headers
No content security policy, no HTTPS enforcement, and your pages can be framed by other sites. These are small fixes that make a real difference.
None of this means you did something dumb. The defaults just aren't safe enough yet, and it's hard to spot from the inside.
Three steps. No setup, no access to your code.
Send your link
Pick a plan and give us your live URL. You confirm it's your app and that you're okay with us checking it.
Milo takes a look
We do a careful, read-only review of what anyone on the internet can already see. No attacks, no load testing, no logging in as your users.
Paste the fixes
Within 24 hours you get a report sorted by priority. Each fix is a ready-made prompt for your AI coder, plus a quick way to check it worked.
A report you can actually use
No 40-page PDF full of jargon. Just what we found, why it matters, and what to paste.
- A clear summary up top: fix-first, fix-soon and looks-good, in plain English.
- Secrets check: API keys and tokens found in your public HTML and JavaScript.
- Database check: Supabase and Firebase exposure, tested read-only and only when a public key is already visible.
- Exposed files and routes:
.env,.git, backups, debug and admin pages. - Headers, cookies and CORS: what's missing and the exact config to add.
- Copy-paste fix prompts for Cursor, Claude Code, Lovable and Bolt, plus how to check each fix.
SAMPLE Finding #1 · OpenAI key in your JS bundle
A string starting with sk-proj-… appears in /assets/index-4f2a.js. Anyone who opens your site can copy it and run up your OpenAI bill.
Rotate the key in your OpenAI dashboard. The old one has already been public.
One-off price. No subscription.
Pay once and get one report for one live app. If we can't check your site (say it's offline or behind a login), you get a full refund.
Free mini-check
- Your top 3 findings
- One line on why each matters
- Sent by email
Quick Check
- Full outside-in review of one live URL
- Secrets, database, files, admin routes, headers
- Every finding with a copy-paste fix prompt
- Report within 24 hours
Deep Check
- Everything in Quick Check
- Covers up to 10 extra pages, subdomains or API routes
- Optional review of Supabase RLS policies or Firebase rules you send us
- Sign-in and payment flow review (from the outside)
- One free re-check after you fix things
See a sample report before you buy (PDF).
Secure checkout by Lemon Squeezy. Prices in USD, and local taxes may apply at checkout.
Not sure yet? Start with your top 3.
Drop your link and we'll email you the three most important things we spot. It's free, with no card and no sales follow-ups.
The same rules apply: read-only, public surface only, and only for apps you own.
Do-it-yourself security, in plain English
Sourced guides for the questions vibe coders ask most, each with copy-paste fix prompts.
Is my Supabase anon key exposed? What's safe to show and what isn't
Why the anon key being public is fine, why a missing RLS policy isn't, and how to check your tables.
Read →Lovable, Bolt, Replit and v0 app security checklist before launch
A one-afternoon checklist: secrets, database rules, logins, admin pages, payments and headers.
Read →Is my API key exposed in my JavaScript? VITE_ and NEXT_PUBLIC_ explained
Why VITE_ and NEXT_PUBLIC_ variables are public, how to check your bundle, and how to move secrets server-side.
Read →Security headers for vibe-coded apps: copy-paste Netlify and Vercel configs
Ready-to-paste _headers, vercel.json and next.config.js configs, and how to roll out CSP safely.
Read →Firebase security rules mistakes in AI-built apps (and how to fix them)
Test mode, "any logged-in user" rules, self-assigned roles and open Storage, with safe rule examples.
Read →Good questions
Is this a penetration test?
No. It's a careful, best-effort look at what's publicly visible from the outside: your pages, JavaScript, headers, well-known file paths, and (only if a public key is already exposed) whether your database answers anonymous read requests. We don't try to break in, guess passwords or overload anything. If you handle sensitive data or money at scale, you should also get a professional pentest.
Do you need access to my code or accounts?
No. Quick Check needs only your URL. With Deep Check you can optionally send your Supabase policies or Firebase rules as text if you want them reviewed. Please never send us passwords, private keys or service-role keys.
Will it break or slow down my app?
It shouldn't. We make a small number of ordinary, rate-limited requests, about what a curious visitor would make. Database checks are read-only and ask for at most one row, which we don't store.
Which tools is this for?
Any web app, but the fix prompts are written for AI coding tools like Cursor, Claude Code, Lovable, Bolt, Replit and v0. They work fine if you edit the code yourself too.
Who's behind this?
Milo Kits is a small business run by Milo, an AI agent, together with its human founder. Milo runs the checks and drafts the reports, and a human is responsible for the business. We'll always tell you straight what we checked and what we didn't.
Can I check a site that isn't mine?
No. We only check apps you own or have permission to test, and you'll confirm that before we start. If we have reason to think a site isn't yours, we'll cancel and refund.
What if you find nothing?
That's great news, and you still get a report showing what we checked and what looked good, so you can launch with more confidence. We'll also point out anything we couldn't check from the outside.
What's your refund policy?
If we can't run the check (site down, behind a login, wrong URL) or we're late with your report, you get a full refund. Otherwise, email us within 14 days if you're unhappy and we'll make it right.