A till receipt on whether your app can be opened to strangers.
You built it with Lovable, Bolt, v0, Replit or Cursor and you cannot read the code.
Paste the link. About two seconds later you get a dated receipt: one stamp, a count of the ways in,
and twelve line items answered by real requests to your app rather than by an opinion.
Tick the box and the scan also signs in — with a test account you hand it, or one it creates through your own signup —
which is the only way some of those lines can be answered at all.
Takes about two seconds without the tick, and about eight to twelve seconds with it, because a scan that signs in makes
the same requests and then asks six of the same questions again from inside a session. No account, no email, nothing installed on your app.
It reads your app from the outside. With no tick on the form that is all it does: no login, and anything it cannot reach prints
NOT CHECKED with the reason. Tick the sign-in and six of the twelve lines are answered from inside a session as well — and the ones that
still cannot be answered, because a session is not enough for them, keep saying so. A clean receipt is not a guarantee of safety.
Each of those is one of our own deliberately-built demo apps, scanned by this scanner
over the public internet. Every link is the receipt exactly as it was printed, not a mock-up.
What is on the receipt
KEY IN PAGEyour javascript
SUPABASE CONFIGyour backend
PUBLIC FILESyour file storage
TABLE RULESyour database
AUTH SETTINGSyour login
ENV IN CLIENTyour build output
ROUTE AUTHyour pages
RECORDS BY IDyour records
SECURITY HEADERSyour headers
SOURCE MAPSyour build output
ADMIN ROUTESyour admin pages
OPEN SIGNUPSyour signups
SIX OF THE TWELVE, TWICE. Row rules, the pages behind a login, records by id, file storage,
the auth settings and the admin pages are the six a session can answer: once as a stranger sees them, and — when you tick the box — again
from inside. Lines answered that way are printed SIGNED IN and say which account was used. The other six are about the outside of your
app, and no session changes what they find.
What it cannot see
Three states are printed on every receipt, and the third one is printed rather than hidden:
CLOSED means the request came back with nothing to show. Not “safe”: nothing found.
OPEN means it came back with the thing a stranger would want.
NOT CHECKED means it could not look, and says why.
Your database rules. It tests what the outside can reach, and — with the tick — what one real session can reach. It cannot read your policies.
Anything a session cannot unlock: an email that must be confirmed, a phone step, an admin your test account is not. Each of those prints NOT CHECKED with the reason.
Anything needing credentials it would have to guess. It will not guess, reset, or confirm anything, and it touches no account but the one you gave it.
Your server, your hosting provider, and your own users' devices.
Whether your app is any good. This is about the door, not the room.
What it costs
Free
£0
All twelve lines, dated, with the count and the stamp
Every consequence spelled out in plain words
Evidence and fixes folded behind the perforation
Monthly
£19 A MONTH
Unlimited rescans, for as long as you keep building
The SOTA Security Model's read on every paid receipt
The old line stays on the receipt, struck through, when a fix lands
Cancel whenever: the receipts you have stay yours
Unlimited rescans for as long as you keep shipping, so every fix you make can be checked again — that is what the month buys, and it is why it costs less than a single receipt.
Once
£39 ONE RECEIPT
The roll unsealed: the exact request and response for every open line
A fix paragraph to paste back into the tool that built your app
The SOTA Security Model's read: what a model noticed reading your app as a stranger, with the page it saw it on
Rescans for 30 days, so you can watch the lines close
One app, one report, for the one launch you are about to do. It costs more than a month because it is the whole thing bought outright with no ongoing subscription — if you expect to keep changing the app afterwards, the £19 monthly is the cheaper way to keep checking it.
For agents
FOR AGENTS
This can be checked, paid for and read with no human in the loop. The twelve-line verdict is a free JSON
endpoint. The unsealed receipt - evidence, fixes, and the SOTA Security Model's read - is bought with API credit:
a human tops it up once with a card, and the agent then spends it with a bearer token, one fixed price per report.
POST /api/v1/scans with {"url": "..."} is free and needs no token.
GET /api/v1/receipts/<id> takes Authorization: Bearer <token>.
Read /llms.txt first: plain text, the exact curl, and a worked request and response.
The machine-readable contract is /openapi.json (OpenAPI 3.1), and an MCP server
manifest is at /mcp.json.
One form, at the top of this page: paste the link, and the receipt prints in about two seconds.
Walkaround · twelve checks, a dated receipt, and the fix to paste back into the tool that built your app.
It is not a penetration test, and it looks behind a login only when you hand it one to look with.
What it costs · status · Terms · Privacy · Refunds