Your AI wrote the code. We proofread it.
Paste your repo from Lovable, Bolt, Cursor, Claude Code or any other AI tool. Redproof marks every hole in plain words: who can read your data, which keys leak, what could run up your bill. A developer checks every serious one, and you get the fix.
- import { createClient } from"npm:@supabase/supabase-js";
- import OpenAI from"npm:openai";
- const db = createClient(URL, "eyJhbGciOi…service_role"); your secret key is in the codeDeno.env.get("SERVICE_KEY")
- Deno.serve(async (req) => {
- const { prompt, userId } = await req.json(); trusts whoever calls ituser = auth.getUser()
- const answer = await openai.chat.create({ prompt }); no limit: one script, huge billlimit 20 an hour per user
- await db.from("profiles").update({ credits }).eq("id", userId);
- return Response.json(answer);
- });
What we catch, and how it reads in your report
The six problems behind most leaks and surprise bills in apps built with AI. Every one is explained in plain words, with the exact file and line.
- critical
Who can see your data
The key in your website is public by design. Without the right rules on each table, anyone who opens your site can read it, and sometimes change it.
Database accessTable Anyone on the internet Any signed-in user profiles reads and changes everything reads and changes everything orders reads everything adds own messages nothing only their own emails and phone numbers of every user, readable with the key in your website
- critical
Keys that leak
Anything starting with VITE_ or NEXT_PUBLIC_ ships to every visitor. So does a key pasted into the code. One of them skips every rule you have.
.env (committed to GitHub)VITE_SUPABASE_URL=https://xyzcompany.supabase.co VITE_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIs… VITE_SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOi… STRIPE_SECRET_KEY=sk_live_51N…
VITE_ means this goes to every visitor. The service role key skips all your rules.
- high
Users who make themselves admin
If people can edit their own profile and the role lives on that profile, they can promote themselves. The admin page only hid the button.
supabase/migrations/init.sqlcreate table profiles ( id uuid references auth.users, full_name text, role text default 'user' ); create policy "Users edit own profile" on profiles for update using (auth.uid() = id);they can edit their profile, so they can set role = 'admin'
- high
Pro for free
Paid access switched on by the "thank you" page instead of by Stripe. Anyone can type the address and skip the payment.
src/pages/Success.tsxexport default function Success() { useEffect(() => { supabase.from("profiles").update({ plan: "pro" }) }, []); return <h1>Thanks for upgrading!</h1>; }open /success without paying and you are Pro
- high
The surprise bill
AI and email features anyone can call, as often as they like. One script overnight and the bill is yours.
supabase/functions/send-invite/index.tsDeno.serve(async (req) => { const { email } = await req.json(); await resend.emails.send({ to: email, … }) return new Response("sent"); });no login, no limit. Anyone can send email in your name.
- low
The boring launch stuff
Privacy policy, backups, error alerts, password reset, security headers. Nobody notices them until the day they are missing.
Launch checklist- Privacy policymissing, and you collect emails
- Database backups on
- Error alertsnone
- Password reset works
- Security headersnot set
| Table | Anyone on the internet | Any signed-in user |
|---|---|---|
| profiles | reads and changes everything | reads and changes everything |
| orders | reads everything | adds own |
| messages | nothing | only their own |
emails and phone numbers of every user, readable with the key in your website
We proofread 24 public apps built with AI. 16 had a serious hole.
Edge Functions anyone could trigger, tables anyone could read, secret keys committed to GitHub. Every finding checked by hand.
Lovable already scans my app. Why this?
Run the built-in scans, they are a good first check. They cover one platform and nobody looks at the results with you. Scanners are fast but stop at a list. Human audits are thorough but take days and cost hundreds. Redproof does the first pass in a minute, then a developer confirms it and can fix it.
Free first check
- Built-in scans
- ✓
- Automated scanners
- partly
- Human audits
- ✗
- Redproof
- ✓
Reads your code, not just your website
- Built-in scans
- ✓
- Automated scanners
- partly
- Human audits
- ✓
- Redproof
- ✓
Works for apps from Cursor, Claude Code, Bolt, Replit, ChatGPT and other AI tools
- Built-in scans
- ✗
- Automated scanners
- ✓
- Human audits
- ✓
- Redproof
- ✓
A developer confirms every finding
- Built-in scans
- ✗
- Automated scanners
- ✗
- Human audits
- ✓
- Redproof
- ✓
Explains it in plain words, with a fix prompt
- Built-in scans
- partly
- Automated scanners
- partly
- Human audits
- partly
- Redproof
- ✓
Can fix it for you
- Built-in scans
- partly
- Automated scanners
- ✗
- Human audits
- partly
- Redproof
- ✓
First answer
- Built-in scans
- seconds
- Automated scanners
- minutes
- Human audits
- 1 to 5 days
- Redproof
- a minute
From "I hope it's fine" to "I know it's fine" in three steps
- 1.
Paste your repo
A GitHub link, or a zip exported from Lovable or Bolt. We read the code in memory and never run it.
- 2.342 critical, 3 high
worst: anyone can read your users' profilesSee your score in a minute
Free and without an account: your launch score, the issues by severity and the worst one explained.
- 3.
Enable row level security on profiles and add a policy so users only read their own row…
copied, now paste it into LovableFix it and scan again
The full report, checked by a developer, with a fix prompt per issue for Lovable, Bolt or Cursor. Re-scan and watch the score climb.
Start free. Pay when you know what's wrong.
The score costs nothing. You work directly with the developer who checks your app, and what you paid for the Launch Check is deducted if you upgrade.
Launch Check
Know exactly what to fix.
$79
One-off. Report in up to 24 hours (working days).
- Every finding checked by a developer
- Who can read and change every table
- A fix prompt for each issue
- Free re-scans for 30 days
Launch Ready
We fix it for you.
$990
Fixed price, agreed before we start. Usually 3 to 5 working days.
- Everything in Launch Check
- We fix every critical and high issue
- Re-test and a clean report
- "Proofread by Redproof" badge for your site
Launch & Grow
Launch, then keep it safe.
$2,490
One-off, with a month of support.
- Everything in Launch Ready
- Payments, email and error alerts set up properly
- Speed check for your first 1,000 users
- 30 days of fixes and answers
- First 3 months of the care plan included
After launch: the care plan is $29 a month. Your app is re-scanned every month and you get an alert when a new risk appears. Fixes are quoted separately. Cancel anytime.
Our promise: if we miss a critical issue in a reviewed report and you find it within 30 days, we fix it free.
Before you paste your repo
Something else? Email the developer.
Run Lovable's scan, it is a good first check. It covers Lovable projects only and is fully automated; Lovable itself says its basic scan does not catch everything. Redproof works for any stack (Cursor, Claude Code, Bolt, Replit too), a developer confirms every finding before it reaches you, and we can fix what we find.
A link to your GitHub repository, or a zip of the code exported from Lovable or Bolt. No passwords, no access to your database or your live app.
No. The code is read in memory, never run, and deleted after the scan. We keep the findings: file names, line numbers and short excerpts with any secrets masked. Reports are only reachable through their private link and never appear in search engines.
The free score takes about a minute. A Launch Check report arrives in up to 24 hours on working days, often sooner. Launch Ready fixes usually take 3 to 5 working days, at a fixed price we agree before starting.
Every finding that is not a proven fact: they open the code, confirm the problem is real, remove false alarms and rewrite the explanation so it fits your app. Proven facts, like a secret key in a committed file, are published straight away.
Yes. Redproof reads the code itself, so it works whichever AI wrote it, or if you wrote parts by hand. It recognises apps from Lovable, Bolt, v0, Cursor, Claude Code, Replit, Windsurf and Base44, and checks any React, Next.js, Vue or Node app.
Proven problems, like a secret key in a committed file, appear in your report straight away. A developer checks the rest and you get an email when the full report is ready, in up to 24 hours on working days. Re-scans are free for 30 days, so you can fix things and watch the score climb.
Yes. Agencies and freelancers can send every app before handover; email us and we will set up a price for regular checks.
Yes. Supabase apps get the deepest checks (every table and policy), but Firebase, Next.js API routes, Express servers, Stripe and AI integrations are checked too.
If we miss a critical issue in a reviewed report and you find it within 30 days, we fix it free. No review can promise an app cannot be hacked, but we remove the serious, common problems attackers look for first.
No. Only submit code you own or are allowed to have reviewed. We never test live apps without the owner's permission.
one more thing before you launch
Launch on Friday. Sleep on Saturday.
Get your free score in about a minute. No account, and your code is never run or kept.