Skip to content
ReplayWatch

Free scan for AI-built apps

Is your AI-built app leaking?Find out in 30 seconds.

Free scan for Lovable, Bolt, Replit and Cursor apps. Get a score out of 100 and see exactly what is exposed.

We only load the public page. We do not log in or submit forms. Your email joins the ReplayWatch Signups list, tagged free-scan. Unsubscribe anytime, without buying.

Sample report · harbor.example

Score

72

out of 100

Four things are already public.

Layout sample only. Not a result from a customer site.

  • A secret key is sitting in the page

    high

  • The database answered without a login

    high

  • The signup page never loaded

    medium

  • A basic browser protection is missing

    low

Built for apps from

  • Lovable
  • Bolt
  • Replit
  • Cursor

How it works

Three steps. Then you know.

  1. 01

    Paste the live URL

    We score what a stranger can already see. About a minute. No account. We never log in.

  2. 02

    See what is exposed

    The free result is the score and the problem names. The $9 report, plus tax, adds an explanation and a fix you can paste back into the tool that built the app.

  3. 03

    Keep watching

    Prove the app is yours. Then we rerun the checks. Free is once a day. Pro and Agency check every hour, and again after each production deploy.

What you see

The leaks, in plain sight.

Illustrations below are samples. They are not results from a customer app.

A key a stranger can copy

Secret keys in the page or the JavaScript are public. We flag them. Publishable keys stay quiet.

Sample
// harbor.example — sample, not a real key
const config = {
  url: "https://harbor.example",
  service_role: "eyJhbGci…"
}

A database that answers anyone

Sample

Supabase or Firebase should not hand over rows with no login.

Anonymous read · 1 row

emailplan
a…@harbor.examplepro

Sample table. Not customer data.

Know when a check fails

After you prove the app is yours, checks keep running. Free is daily. Pro and Agency are hourly, plus a run after each production deploy.

Sample

Sample check history. Two failures. Not a live app, and not an uptime percentage.

The protections the page forgot

We read the headers that should ship with every public page, then name the ones that are missing.

Sample
  • Strict-Transport-SecurityMissing
  • Content-Security-PolicyMissing
  • X-Content-Type-OptionsPresent
  • Referrer-PolicyMissing

What we check

The stuff that gets an app in trouble.

  • Secret keys

    Keys left in the HTML or the JavaScript. Publishable keys are ignored.

  • Open databases

    A Supabase or Firebase project that answers without a login.

  • Browser protections

    The basic headers a public page should send, and the ones it skipped.

  • Broken links and files

    Pages, images, scripts, and stylesheets that fail while the public page loads.

  • Search basics

    Title, description, language, and a heading. Unquoted tags still count.

  • A signup page that loads

    We look for a signup link and check that the page is reachable. We do not submit it.

Pricing

Start free. Pay when you want the fix.

The scan is free. The written report is $9 once. Monitoring is billed monthly. Prices are in USD and do not include tax.

Questions about pricing

Instant scan

Freeone look

Paste a URL. Get a score out of 100 and the name of each problem. We email the same summary.

  • Read-only. No login.
  • One public page. Not ongoing checks.
Scan an app

Full report

$9once

+ tax

Each problem gets a plain-English explanation and a fix you can paste into the tool that built the app.

  • Promo codes work at checkout.
  • We email the report after you pay.
Start with a free scan

Manual audit

$99once

+ tax

One app. The scan, plus a written list of fixes. No turnaround promise.

  • One app.
  • The scan, plus a written list of fixes.
  • No turnaround promise.
Request an audit

Free monitoring

$0forever

1 app. 1 flow. Checked once a day. Run it now whenever you want.

  • Prove ownership before any automated run.
  • No card.
Create an account

Pro

Recommended

$19per month

+ tax

3 apps and 3 flows. Hourly checks, plus a check after each production deploy.

  • A flake is retried once. We email after two failures.
  • Promo codes work at checkout.
Start Pro

Agency

$49per month

+ tax

10 apps and 50 flows. Same hourly checks and post-deploy runs as Pro.

  • For a studio shipping several client apps.
  • Customer portal to change or cancel.
Start Agency

Questions

What do I get for free?

A score out of 100 and the name of each problem from one read of the public page. The same summary is emailed when email is configured.

What is the $9 for?

A one-time unlock. Each problem gets a plain-English explanation and a fix prompt you can paste into Lovable, Bolt, Replit, or Cursor. Tax is added at checkout.

Will you log into my app?

No. The public scan only loads pages and files. It does not fill inputs or submit a form.

When do the ongoing checks start?

After you prove you own the app, with a DNS TXT record or a file at /.well-known/replaywatch.txt. Nothing automated runs before that.

Find out before your users do.

One public page. A score out of 100. No account for the scan.

Scan an app freeStart monitoring