New name Formerly Launch Guard
Check your AI‑built app before real users do.
Apps made with Lovable, Bolt, Replit, Cursor, v0 or Bubble can leak keys or open up user data. DeployVet looks for these holes and for broken pages. You get a clear list of what to fix.
Free. No card. Only check sites you own.
Works with Lovable · Bolt · Replit · Cursor · v0 · Bubble · Supabase
Reports / example-app.com
Sample report
- HighTableSupabase
profilescan be read without loginRow Level Security is off. Anyone with the public key can read it. - MedSecret-looking key in JS bundleBundle
assets/index-4f2a.js, line 1 - MedRoutes
/adminloads with no loginReturns 200 to a stranger. - LowMissing security headersCSP, HSTSHeaders
Fix prompt for Lovable
Turn on Row Level Security for the profiles table. Only let a user read their own row where auth.uid() = id.
01 · What we check
What a stranger could find on your site.
The Free Check looks at your live site from the outside, like a stranger would. Here is what it looks for, with examples.
-
Leaked keys
We scan your JS files for secret keys that should never reach the browser.
// assets/index-4f2a.js (example) const stripe = Stripe("sk_live_••••••••••3kQ"); ↑ A secret key. It belongs on the server.
-
Open Supabase data
We find your public Supabase key and test if Row Level Security keeps tables closed.
-- what we test, with your public key select email from profiles limit 1; → 1 row returned. RLS is off. fix: alter table profiles enable row level security;
-
Open admin and API routes
We look for admin pages and API paths that work with no login.
# no cookie, no token GET /admin 200 OK GET /api/users 200 OK
Security headers
We check the headers that guard your site from common web attacks.
Mixed content
We flag files that load over plain http on a secure page.
Broken pages
We find pages and links that fail before your users hit them.
02 · Free vs paid
DeployVet Scan goes deeper.
Link your repo or Supabase project. We get read-only access, so we can look but not change things. You also get fix prompts you can paste right into your builder.
| What you get | Free Check | Scan | Pro |
|---|---|---|---|
| Outside scan of your live site | Yes | Yes | Yes |
| Score and count of issues | Yes | Yes | Yes |
| Full details and fix | Worst issue only | Every issue | Every issue |
| Read-only check of repo or Supabase | No | Yes | Yes |
| Fix prompts for your builder | No | Yes | Yes |
| PDF report | No | Yes | Yes |
| Weekly scans and email alerts | No | No | Yes |
| Scan history | No | No | Yes |
03 · How it works
Four steps. You pay first.
For a paid scan, you pay first. Then the scan runs. No surprise charges later.
- 1
Add your site
Type in your app's web address.
- 2
Prove you own it
Add a DNS TXT record or a meta tag. We only check sites you own.
deployvet-verify=•••• - 3
Pay, if you want more
The Free Check costs nothing. For a full scan, you pay the price shown up front.
- 4
Get your report
See each issue, how bad it is and how to fix it.
04 · Pricing
Clear prices.
You see the full cost before you pay.
DeployVet Free Check
$0
- One outside scan per site each month
- Your score and count of issues
- Full details and fix for the worst issue
DeployVet Scan
$7 once
- Pay first, then the scan runs
- Every issue, with proof and a fix
- Read-only check of your repo or Supabase
- Fix prompts for your builder
- PDF report
DeployVet Pro
$15 / month
or $150 a year
- Everything in DeployVet Scan
- Weekly scans with email alerts
- Scan history to see what changed
- Billed up front each month or year
- Cancel any time
What is DeployVet?
DeployVet checks apps built with AI and no-code tools for security holes and bugs. It was made by Hayden Young. It used to be called Launch Guard.
Which tools do you support?
Lovable, Bolt, Replit, Cursor, v0 and Bubble. Apps that use Supabase work too.
Is this a penetration test?
No. DeployVet is not a penetration test. It finds common, known issues. If your app holds very private data or payments, get a pro security review too.
Do you need my code or database?
Not for the Free Check. It only looks at your public site. The paid DeployVet Scan asks for read-only access to your repo or Supabase project. We can read but not change anything.
Can I check an app I don't own?
No. You must prove you own the site with a DNS TXT record or a meta tag first.
Will you charge me later?
No surprise charges. You pay for a DeployVet Scan before it runs. Pro is billed up front each month or year, and you can cancel any time.
Does a clean report mean my app is safe?
No tool can promise that. A clean report means we did not find the issues we check for. Think of it as a health check.
Does DeployVet fix my app?
No. We never change your app. We tell you what is wrong and give you steps and prompts to fix it.
How do I get help?
Email support@deployvet.com.
Newsletter
Ship your AI-built app without leaking user data
One 5-minute security check every week for Lovable, Bolt, Replit, Cursor and Bubble builders. Sign up and get our free 10-minute pre-launch checklist.