Your AI built the app.
LatchDog checks the locks.
Weekly and per-deploy security checks for apps built with Lovable, Bolt, Cursor, Replit and v0. Find leaked API keys, Supabase tables anyone can read, and missing security headers, with a fix prompt you paste straight into your AI tool.
Free, read-only public check: no sign-up, no card. Headers and HTTPS only. Deep scan (leaked keys, open Supabase tables, .env/.git) after you verify you own the domain.
🔑 Leaked secrets
Supabase service_role, OpenAI, Anthropic and Stripe secret keys hiding in your JS bundles and source maps.
🗄️ Open Supabase tables
Tables readable with your public anon key because RLS is off. One LIMIT 1 check, no data stored.
🧱 Headers & HTTPS
CSP, HSTS, clickjacking protection, nosniff, referrer policy, HTTPS redirects.
📂 Exposed files
Public .env files, .git folders and production source maps.
How it works
- Paste your URL for a free public check.
- Verify you own the domain (DNS TXT, meta tag, or a file).
- Get a deep scan with a severity and a copy-paste fix prompt for every issue.
- LatchDog re-scans weekly (and after every deploy on Pro), and emails you only what changed.
Why AI-built apps need this
AI coding tools ship fast and change a lot of code every time you prompt them. A fix you made last week can quietly come undone in the next deploy. LatchDog watches from the outside, the way an attacker would, so you hear about it first.
One vibe-code security fix a day
AI wrote your app fast. These emails help you lock it down. Each one covers a single, specific issue we see in AI-built apps (open database rules, leaked API keys, missing auth checks) and how to fix it in a few minutes.
One short email a day. Free. Unsubscribe in one click from any email. We'll never sell or share your address. Privacy policy