Prodable’s free check runs about 48 read-only tests across 9 areas against your live app — the same view an attacker gets from the outside, with no login and no access to your code. It never changes your data, never logs in, and stores only the URL, the findings, and (if you ask) your email. Here’s exactly what that means.
Ordered the way they matter — the ones that can actually get you breached first.
We pull the keys your app ships to the browser (they're public by design) and use them to try the exact requests an attacker would — reading tables that should need a login, writing where they shouldn't. This is the check that catches the #1 flaw in AI-built apps: a Supabase database anyone can read.
We verify HTTPS is enforced, the certificate is valid, and connections can't be silently downgraded to unencrypted.
The headers that stop your app being framed by a phishing site, sniffed for the wrong content type, or leaking where your users came from. AI builders routinely ship without them.
We check SPF, DKIM, and DMARC — the records that stop scammers sending 'password reset' emails that look like they came from you.
Exposed keys in your JavaScript bundle, source maps that recover your original code, and open files like .env, .git, or an admin API doc. We probe the common paths an attacker checks first.
Secret keys, private API endpoints, and test/production key mix-ups hiding in the JavaScript your app sends to every visitor.
Session cookies missing the flags that keep them out of reach of malicious scripts and cross-site requests.
CORS rules that let any website call your backend with a logged-in user's credentials, and other config that quietly opens a door.
Cosmetic and privacy-posture checks — these can't sink your grade on their own, but they round out the picture.
Full detail in our privacy policy and scan-consent pages.
Yes. Every request is look-only — the same kind your own visitors' browsers make, plus a few harmless knocks on the addresses your app already uses. We never write data, never log in, and never run anything that could slow down or take down your app. If your host rate-limits us, the check backs off rather than pushing.
No — the free check runs entirely from the outside, against your live URL, exactly like an attacker with no inside access. Code review only happens if you buy the Complete package and hand us a GitHub or Lovable share link on purpose.
Each of the 9 areas gets its own sub-score, then those are combined into a weighted average — the security-heavy areas (Database & APIs, Encryption, Browser protections) carry the most weight, so a real exposure tanks your grade while a cosmetic gap barely moves it. The result is an A+ through F. We deliberately don't inflate the grade with easy passes or scare you with severity you don't have.
We see only what any visitor to your site could already see — that's the whole point of an external check. We don't retain the contents of what we find beyond the finding itself (e.g. 'a Stripe key is exposed in your bundle'), and the report is yours. If something is exposed, it was exposed to the entire internet before we looked; the check is how you find out before someone with worse intentions does.
Two ways. First, independence: a platform will never be the neutral auditor of its own output, and its scan only sees its own half of your stack. We check the seams between Supabase, Stripe, your host, and your domain — where things actually break. Second, we test your live deployed app from the outside, the way an attacker meets it, not just your source before it ships.
The full graded verdict, in about 60 seconds. No login, nothing to install.