Free security scan · Pro Logica Cybersecurity
AI App Security Check
Your AI-built app may be handing out your keys and your customers' data. Find out in 60 seconds.
Lovable, Bolt, Replit, Cursor and v0 ship fast, and they often ship leaked API keys, databases anyone can read, and missing browser protections. We check 26 of these weak spots from the outside, the same way an attacker would look, and show you exactly what's exposed.
- Leaked API keys & tokens
- Open databases (Database Check)
- Missing security headers & exposed files
Lovable, Bolt, Replit, Cursor and v0 ship fast, and they often ship leaked API keys, databases anyone can read, and missing browser protections. We check 26 of these weak spots from the outside, the same way an attacker would look, and show you exactly what's exposed.
- Leaked API keys & tokens
- Open databases (Database Check)
- Missing security headers & exposed files
From our scan of 18 public AI-built apps · October 20, 2026
Not one of them had the browser protection that stops injected scripts from stealing sessions. Is yours the same?
Pro Logica passive scan of apps listed on public Lovable and Bolt showcases. Hostnames anonymized. Keys and databases were not tested on these apps.
Check my appFrom "is it safe?" to fixed, in three steps
- 1
Scan free.
Paste your URL. In about a minute we run 26 passive checks on what your live app shows to the world. No login, no install, nothing changed.
- 2
See your risks.
You get a 0–100 security score, a letter grade and every issue found, sorted by severity. Your most serious issue is shown in full, free.
- 3
Get the step-by-step Fix Guide.
Unlock the exact fix for every issue: what's wrong in plain words, what to do first, numbered steps, and copy-paste prompts your AI builder can run for you. Then re-check free to prove it's fixed.
What we check, and what each problem costs you
Every check maps to the OWASP Top 10 or a CWE id, so any developer knows exactly what it means.
AI-built apps
Exposed secrets
Live API keys and tokens sitting in your page code. Anyone who finds one can run up charges on your account or reach your data. Always masked in our report.
CWE-798
Database Check
Whether anyone on the internet can read your app's tables or realtime database with the public browser key. If they can, your customer list is effectively public.
OWASP A01 · CWE-284
Exposed files
.env files, Git folders and source maps published by mistake. These can hand over passwords, database addresses and your full source code.
CWE-538
Cross-origin access
CORS rules that let any website read responses from your app, including with your users' logins.
CWE-942
Sign-up settings
Open sign-up with auto-confirmed email, so anyone can create a working account.
OWASP A07
Indexability
noindex, title, meta description, sitemap. If Google can't index you, customers can't find you.
Passive external check. Not a penetration test and not a malware scan.
Run these 26 checks on my appOne leak can cost you more than the app made
Data leak.
If your database or a key is exposed, your customers' names, emails and records can be copied by anyone who looks. You'd have to tell them, and some never come back.
Lost trust.
Buyers check. A browser security warning, a leaked-key incident or a public breach post ends deals before they start.
Downtime and surprise bills.
A stolen API key gets used until it's maxed out, and then your app stops working. You pay the bill and you lose the days it takes to clean up.
Attackers use automated tools to look for exactly these mistakes. The good news: most of them are quick to fix once you know where they are.
Find out where you stand, freeThe free scan shows the problem. The Fix Guide solves it.
Free scan
- security score and grade
- every issue found, by severity
- your most serious issue in full
- emailed results link
Fix Guide (unlock)
- every issue explained in plain words
- ranked by urgency: fix this week, this sprint, when convenient
- numbered step-by-step fix for each issue
- copy-paste prompts or code for Lovable, Bolt, Replit, Cursor or v0
- masked evidence and OWASP/CWE reference for your developer
- a PDF to keep and share with your team
- one free re-check within 14 days to confirm it's fixed
Built by a cybersecurity team, not a chatbot
Real checks, not an AI essay.
Every finding comes from a live response from your app: a header, a file, a key pattern, a database answer. You see the evidence.
Safe by design.
Read-only requests, paced, capped at about 40 per scan, robots.txt respected. We never log in, submit forms or change anything. Database checks run only after you confirm you own the app.
Your secrets stay secret.
Any key we find is masked in the report and email. We never ask for passwords or access.
Standards your developer knows.
Each issue maps to the OWASP Top 10 and CWE.
Real people behind it.
Pro Logica Cybersecurity · 120 Newport Center Drive, Suite 100, Newport Beach, CA · support@prologica.ai · 949-205-7333.
How the check works
- 1
Fetch public pages & JavaScript
We load your homepage and same-site JavaScript bundles like a normal visitor, respecting robots.txt, capped at about 40 paced requests.
- 2
Run 26+ passive checks for your site type
Headers, HTTPS, public files, exposed keys, database rules and indexability, plus the WordPress or AI agent checks when we detect them. Page requests only, except two read-only MCP discovery messages to an MCP address on your own host. Nothing is written or logged in to.
- 3
Score & explain
Each issue is weighted by severity into a 0–100 score, with plain-English impact, evidence and a step-by-step fix.
Questions
Is the scan really free?
Yes. The scan, your score, every issue found and your most serious issue in full are free. No credit card.
What's the difference between the free scan and the Fix Guide?
The free scan tells you what's wrong and how serious it is. The Fix Guide tells you exactly how to fix each issue: plain-English explanation, which to fix first, numbered steps, copy-paste prompts for your AI builder, a PDF and a free re-check. You see the price on the secure Stripe checkout page before you pay.
I'm not technical. Can I still fix these?
Yes. That's what the copy-paste prompts are for: you paste them into Lovable, Bolt, Replit, Cursor or v0 and the builder makes the change. Each fix also has plain steps you can hand to a developer.
How do I know the fix worked?
The Fix Guide includes one free re-check within 14 days. Run it after you fix things and see your new score.
Is it safe to run on my live app?
Yes. The check is passive: it sends ordinary page requests (GET and HEAD; for an MCP address on your host, only the read-only initialize and tools/list messages), paces them out, caps each scan at about 40 requests and respects robots.txt. It never logs in, submits forms or writes data.
What do you access?
Only what any visitor can already see: your public pages, JavaScript bundles, response headers, TLS certificate and a few well-known public paths such as /.env and /.git/HEAD. We never ask for passwords or keys, and any secret we detect is masked in the report.
How is the score calculated?
Every app starts at 100. Each finding subtracts a fixed weight based on its severity: a live secret or a readable database costs the most, a missing low-impact header the least. The result is a 0–100 score with a letter grade.
Is this a malware scan?
No. It's a passive check of what your site exposes publicly. Finding malware needs access to your server files and database.
Do you sell my email?
No. We use it to send your results and security tips from Pro Logica. Unsubscribe anytime with one click.
Every day an exposed key stays live, anyone can use it. Check your app now.
Scan my app free