Free check
Free access check: can strangers read your app's data?
Send me the link to your Lovable, Bolt, Replit, or v0 app. I test, from the outside and with no login, whether a stranger can read your database, find a secret key, or list your users' files. You get the result by email within two working days.
It's free, I only read, and I don't need a password or an invite to anything.
What happens next
- 01
You send the link
Just the address of the live app and an email for the result.
- 02
I run three tests
Database rows, secret keys, and uploaded files, all as a visitor with no account.
- 03
You get a short email
Within two working days: what's open, what's closed, and what I couldn't test. If it's all closed, the email says so.
The three things I test, and how
Each test asks one question a stranger could answer about your app today, using nothing but a browser.
01 · Database rows
Can someone with no account read your users' data?
How I test it. Your app's front end talks to Supabase with a public key that sits in every visitor's browser. I use that same key, with no login, and ask each table for a single row. If a row comes back from a table that holds user data, anyone on the internet can read that table.
Why it gets missed. Row Level Security decides which rows the public key can reach. The app works in the builder's preview whether the rules are right or not, because you only ever test it logged in as yourself. In May 2025, CVE-2025-48757 was published for Lovable-generated apps whose rules let visitors with no login read or write database tables. Lovable disputes the record, saying each customer is responsible for protecting their own app's data.
02 · Secret keys
Is a secret key sitting in the code your app sends to browsers?
How I test it. I read the JavaScript your app serves to every visitor and look for keys that should never be there: a Supabase service role or secret key, a Stripe secret key, or an AI provider key. I only note that a key is present. I never use one.
Why it gets missed. Supabase's public key is safe in the browser when the access rules are right. Its service role and secret keys skip those rules, so Supabase says to keep them on the server. AI builders sometimes paste a secret key into front-end code to make a feature work, and nothing in the preview shows that it's now public.
03 · Uploaded files
Can a stranger list or open the files your users upload?
How I test it. With the same public key and no login, I ask each storage bucket for its file list. If the list comes back, anyone can see what your users uploaded. I note the bucket name and stop. I don't open or download the files.
Why it gets missed. Files in a public Supabase bucket open for anyone who has the link, and private buckets rely on access rules like tables do. A bucket made public to get image uploads working during a build often stays public after invoices or ID photos start going into it.
Sources, checked November 2026
What the access check doesn't cover
The check answers one question: what can someone with no account reach? A clean result is good news, but it isn't a full review. These are left out on purpose:
- Whether one logged-in user can read another user's data. That needs test accounts, so it's part of the paid review.
- Logins, password resets, and email delivery.
- Stripe webhooks and anything else that runs on the server.
- Hosting, backups, and who owns the accounts.
To check those yourself, work through the launch checklist. To have them checked on your actual code and accounts, the Launch-Ready Review is $900–1,500, takes 3–5 days, and ends in a written report with a fixed price for each fix.
FAQs
Is the access check really free?
Yes. There's no card, no call, and nothing to sign. You send the link, I run three tests from the outside, and I email what I find within two working days. If something is open, the email says what and where. Fixing it is up to you: do it yourself, hand it to your developer, or ask me for a price.
Do you need my password or an invite to my project?
No. The check only uses what any visitor to your app already receives: the pages, the JavaScript, and the public key inside it. I don't log in, I don't create an account, and I don't need access to Lovable, Supabase, or your code. That's the point of the check: it shows what a stranger can reach.
Will the check change or damage anything in my app?
No. Every test only reads. I never add, change, or delete a row, and I never use a secret key if I find one. When a table answers, I ask for one row to prove it's open and stop there. I don't download or keep your users' data, and I don't share the result with anyone but you.
If nothing is found, is my app secure?
Not necessarily. A clean result means a stranger with no account can't read your tables, keys, or file lists today. It doesn't test whether one logged-in user can read another user's data, which is a common gap in apps built with AI tools. It also skips logins, Stripe, and backups. Those need access to the code and accounts.
My app doesn't use Supabase. Can you still check it?
Partly. The secret key test works on any web app, because it reads the code your app sends to browsers. The database and file tests are written for Supabase, which Lovable and many Bolt apps use. If your app runs on Firebase or Replit's own database, send it anyway and I'll tell you what I could and couldn't test.
How is this different from the Launch-Ready Review?
The access check takes three tests from the outside and costs nothing. The Launch-Ready Review is $900–1,500 and takes 3–5 days. For that I work inside your code and accounts and check access rules between users, logins, secret keys, Stripe webhooks, hosting, and backups. You get a written report with a fixed price for each fix.