For apps built with AI, or by hand · Free check, no signup

Does your app actually work for a real customer?

Your app can pass a security scan and still lose new customers at sign-up, login or checkout. Journey tests that do all three like a real customer are coming soon. Start with the free check: in under a minute, see what any stranger can see.

Built with Lovable, Bolt, Cursor or by hand: if it's live on the web, we can check it.

Checking your app. This takes up to 30 seconds.
  1. Opening your home page
  2. Reading your public JavaScript for leaked keys
  3. Looking for settings files left in public
  4. Checking browser safety settings and Google basics
  5. Checking that sign-up, login and payment pages open

The free check only reads public pages and files, the same way a browser does. It never logs in, fills in forms or reads your data. Please check only apps you own or have permission to check.

Works on apps built or hosted with

  • Lovable
  • Bolt
  • Replit
  • v0
  • Cursor
  • Bubble
  • Base44
  • Supabase
  • Firebase
  • Vercel
  • Netlify

Any public link works, including apps you coded yourself. Not affiliated with these companies.

Why AppFirstAid

Free scanners ask "is it secure?" We also ask "does it work?"

You know how free scanners and the scans built into AI app builders check whether your keys leak and whether your database rules are switched on? Useful, and our free check covers the outside basics too. Then we go further: we sign up, open your email, log in and try checkout like a real customer, and tell you exactly which step broke.

What free scanners and built-in scans usually check

Is anything exposed?

  • Secret keys left in your code
  • Whether database rules are switched on
  • Settings files left in public
  • Missing browser safety settings

Good to know, and mostly free everywhere now. But a rule that's switched on can still be wrong, and none of this tells you whether a new customer can get in.

What AppFirstAid adds

Can a customer get in and pay?

  • Journey testsComing soon: a real browser signs up as a brand-new customer, waits for your welcome or confirmation email, opens its link, logs in, and tries your checkout with a 100%-off code you create. Every step gets a screenshot.
  • MonitorComing soon: we rerun your check and your journey every week and email you what's new, what's fixed and what's still open.
  • Free outside check: leaked keys, public files, safety settings, Google basics, and whether your sign-up, login and checkout pages open at all.

Journey tests and Monitor are built and in final testing. They aren't for sale yet. Email us to hear when they open.

The breaks your customers find first

These are the problems builders talk about after launch. A security scan won't catch them, because nothing is "exposed". The app just doesn't work.

Sign-up fails for new people

It worked for you, because you were already logged in. A stranger hits an error, or never gets the confirmation email.

Login breaks on your real domain

Everything worked on the preview link. On your custom domain, the email link or login sends people back to the old address. How to fix it

They paid, nothing unlocked

The payment went through but the app never heard about it, so the customer is still on the free plan. How to fix it

Free, no signup

What the free outside check looks at

Everything here is visible to anyone who opens your site. If we can see it, so can a stranger.

Leaked keys

Secret keys for Stripe, OpenAI, Supabase, AWS and others sitting in your public JavaScript. We tell public keys (fine) from secret ones (replace now).

Files left in public

Downloadable .env settings files, the .git folder and source maps that hand out your original code.

Browser safety settings

https, HSTS, Content-Security-Policy and the headers that stop other sites from framing your login page.

Sign-up and payment pages

Whether your sign-up, login, pricing and checkout links actually open, or show visitors an error.

Google basics

Leftover "noindex" tags, a robots.txt that blocks everything, default page titles, and missing descriptions or sitemaps.

Your database

We spot when your app uses Supabase or Firebase. Checking whether its tables are open needs you to prove you own the app first.

Peace of mind with MonitorComing soon

AI builders make changes fast, and sometimes a change breaks something that used to work. Monitor reruns your journeys every week and emails you when sign-up, login or checkout stops working, so you can hear it from us before you hear it from a customer.

$15 a month per app. Cancel anytime, and it keeps running until the end of the month you've paid for. It's the only subscription we sell, and you never need it to use anything else.

  • Your safety check rerun every week, hands-off
  • A weekly sign-up, login and checkout journey test, once you set it up
  • A Monday email: what's new, what's fixed, what's still open
  • The fixes on your report, unlocked
Coming soon

Pay once. No subscription needed.

The free check names every problem. If you want help fixing them, pay once for what you need.

Sample report A made-up app

CriticalYour private settings file (.env) can be downloaded Anyone can open /.env and read your database password and API keys.
🔒 Fix promptIn the Fix Pack
HighYour sign-up page shows visitors an error The /signup link on your home page returns an error page.
🔒 Fix promptIn the Fix Pack
One-time prices
  • Free check: every problem named, free, no signup
  • Fix Pack, $9 once per report: a copy-paste fix prompt for every problem, written for Lovable, Bolt, v0, Replit or your builder, or for any AI coding tool if you coded it yourself
  • Journey test, $5 each or 5 for $19Coming soon: credits never expire
  • Monitor, $15/monthComing soon: optional, for hands-off weekly checks
Run your free check first

Built an app for a client?

Every report has its own private link and a print-ready PDF view, so you can hand your client a clean report. Fix prompts stay locked in shared copies unless that report has the Fix Pack.

Plain-English guides

Step-by-step fixes for the problems scanners don't cover: payments that don't unlock, login that breaks on a custom domain, and what built-in scans miss.

Read the guides

Questions

Does it work if I coded my app myself?

Yes. The check works on any public web app, however it was built. We tune each fix prompt for the builder we spot (Lovable, Bolt, v0, Replit). If we can't tell, you get a general version: paste it into any AI coding tool, like Cursor, Copilot, ChatGPT or Claude, or follow it yourself as plain step-by-step instructions.

Find the broken step before your customers do

Start with the free check. About 30 seconds, nothing to install.

Run free check