Your app got stuck halfway. Let's get it moving again.

1. 01

   Paste your app's link

   It is the address anyone types to open your app. From that address we read its home page, up to 12 of the scripts that page loads, and the small proof file from the next step, if you use the file. Step 3 says what else we call for tables.

2. 02

   Show the app is yours

   You add one line to your app's home page, or one small file at /.well-known/lojik-rescue.txt. We look for it before we check anything else, so nobody can check an app that is not theirs. If it is not there, the check shows you nothing.

3. 03

   See what any visitor can reach

   Two things: keys left in the code, and database tables anyone can read. Tables need a second proof, that the Supabase project is yours: you add one small table, then delete it. For them we call your project's own supabase.co address with the public key your app already ships. You see each finding, one by one.

4. 04

   Get the fix for each one

   This step is paid. The full report gives a fix for every finding, written for your app, the top three first.

1. 01

   Keys left in the code

   Secret keys belong on a server. We read your home page and up to 12 scripts it loads from your own address, and look for a fixed list of key types, such as Stripe, OpenAI, Anthropic and Supabase secret keys. Scripts hosted somewhere else are skipped, so a key in one of those is not checked. Each script is read up to 2.5 MB; anything past that is not read. We show only a key's first few characters.

2. 02

   Database tables anyone can read

   If your app uses Supabase, we check up to 40 tables in each of up to 2 projects, the ones the project lists or your app's code names, and ask each how many rows a stranger can read. A table that is open but empty does not show. First you show the project is yours, by adding one small table that you delete afterwards; we read that table's one row to confirm it. We never read a row of your own data, and we never change anything in your project.

The check sees only what a visitor can already see. A clean result does not mean the app is safe, and it cannot read your private code.

1. 01

   The top three first

   We rank everything we found and put the three that matter most at the top, so you know where to start.

2. 02

   The SQL for each open table

   For every table anyone can read: the SQL that lists its policies, a line to drop an open one (you fill in its name), and a policy that limits each row to its owner, which assumes a user_id column. It is written with the table's own name. A table with an unusual name gets plain steps instead of SQL. You paste it into Supabase.

3. 03

   Or a prompt for your builder

   A prompt to paste into Lovable, Bolt or v0. It names the table or the key to deal with. Names only: it never carries a key.