Prodable is a free security scanner for AI-built apps: paste your live URL and get a graded report in about 60 seconds — no signup. It runs about 48 safe checks and shows the three things that sink real apps first: databases anyone can read, secret keys left out in the open, and pages that forget to check who's logged in. Works for apps built with Lovable, Bolt, v0, Cursor, Replit, Bubble, and Base44.
Open databases
We probe your Supabase tables to see whether anyone can read or write your data without logging in. An estimated 70% of Lovable apps fail this check.
Exposed secrets
We read the code your app ships to the browser — and rebuild any hidden code it left exposed — to find leaked keys (Stripe, OpenAI, Google, Supabase and more), password files, and hidden project files. One exposed key lets a stranger run up your bill.
Doors left unlocked
We knock on the hidden web addresses your app uses to find the ones that skip the login check, or hand your data to any website that asks. That's how strangers pull data they should never see.
Look-only checks of your public site. We never log in, change data, or run anything that could break things. The deep, inside-the-code review is part of the Fix, where you give us access to your code.
Yes. Every check is look-only. We make normal requests to your public site plus a few harmless knocks on the addresses it uses — we never log in, change data, or run anything that could break things.
Around 48 checks across 9 areas: databases anyone can read, secret keys left in your code, pages that skip the login check, weak browser protections, cookies, your site's encryption, and email settings that stop scammers spoofing you. You get an A+ to F grade and see the most urgent issues first.
No. The scan and your graded verdict are free with no account. You only enter an email if you want to unlock the full line-item report and AI-ready fix prompts.
Your grade and top findings stay free either way. If we find a live exposure, a senior dev can fix it for you — the Fix, a flat $499 with the code-level pass included — and re-scan to show before and after.