How the check works
AppFirstAid looks at your app the way a curious stranger could: from the outside, reading only what's public.
1. Paste your link
We open your home page and the public JavaScript files it loads, plus a few well-known addresses like /.env, /.git/HEAD, /robots.txt and /sitemap.xml. We also open common sign-up, login, pricing and checkout pages to see if they load.
2. See every problem
Each problem gets a seriousness level and a plain-English reason it matters. "Confirmed" means we saw it ourselves. "Worth a look" means it's likely, and worth checking. Any key we find is shown partly hidden. We never try a key we find.
3. Paste the fix
With the Fix Pack, every problem comes with a prompt written for the tool you built with. Paste it into Lovable, Bolt, v0, Replit or your AI coding tool, republish, and check again.
What we never do
- We never log in, fill in forms, submit anything or try passwords.
- We only send GET and HEAD requests, the same kind a browser sends when it opens a page.
- We never use a key we find, and we never read rows from your database.
- We refuse private and internal addresses.
How to recognise us
Our requests identify themselves honestly with this user agent: AppFirstAidCheck/0.1 (+https://appfirstaid.com/how-it-works; passive, read-only)
If you run a site and don't want it checked, email hello@appfirstaid.com and we'll add it to our do-not-check list.
Limits
An outside-in check can't see everything. It can't see server code, private settings or what happens after login. A clean result is a good sign, not a guarantee.