AppPulse

For founders shipping with Lovable, Bolt, Cursor, Replit, or v0

Know if your live app is leaking before your users do.

A weekly health check for the app you shipped without an engineer.

  • Outside-in scan. No install, no code access, no writes.
  • Plain-English findings, each with a prompt you can paste back into your AI tool.
  • Paid plans watch the site daily and email you when something new breaks.
Free one-time scan
Paste the public URL. We read what a stranger on the internet can already see.

If you leave an email, we add it to the AppPulse list so we can send product updates. The scan still runs if that list is down.

Read-only. We GET public pages and DNS records. We do not log in, submit forms, or write to your database. Three scans an hour from this network.

What usually slips through

Keys in the bundle
The model put a Stripe or Supabase secret in a file the browser downloads. Anyone who loads the page can copy it.
Tables with no lock
Supabase created the table and left row-level security off. The anon key, which is supposed to be public, can read every row.
The quiet failure
Signup looks fine on your laptop. A missing header, an expired certificate, or a webhook that never returns 200 shows up for customers first.

What the free scan checks

All guides

Leaked API keys in the client bundle

Secret keys that an AI coding tool left inside JavaScript the browser downloads.

Exposed .env file

A request for /.env, /.env.local, or /.env.production returns real environment variables.

Exposed .git directory

The Git metadata for the project can be downloaded from the website.

Missing security headers

The homepage response is missing the headers that tell browsers how to behave.

HTTPS and the certificate

The site is still on HTTP, or the certificate is expired, untrusted, or about to expire.

Supabase tables without row-level security

The anon key in the browser can read tables that were meant to stay private.

SPF and DMARC

The domain does not tell inbox providers who is allowed to send its mail.

Stripe webhooks that fail quietly

Checkout can look successful while the account never hears that the payment completed.

1

Scan the public site

URL in, report out. No account for the first look.

2

Prove you own it

Add a DNS TXT record, a meta tag, or a small file before we watch it on a schedule.

3

Get Monday’s note

Daily scans and up to three uptime checks. An email when a new issue appears, and a weekly summary.

Plans

Compare
Free
A one-time outside-in scan of any public URL. No account required.

$0

Starter
Daily scans, uptime checks, and a Monday email for one live app.

$19/mo

Pro
The same monitoring for up to five apps.

$49/mo