For apps built with AI
Know the moment your app starts leaking.
You built it with Lovable, Bolt, or Cursor. Security Watch checks it every week from the outside, the way a stranger would, and emails you in plain English when something risky shows up. With the exact prompt to fix it.
AI app builders move fast, and sometimes they put a secret key into the code every visitor downloads, or ship without the basic safety settings a website needs. Nothing warns you. You find out from a surprise bill or an upset user. Security Watch is a weekly outside check for exactly those mistakes, written for people who never studied security and should not have to.
How it works
What lands in your inbox
One email a week. When something new and risky shows up, it leads, with the fix right underneath.
myapp.lovable.app
Safety score: 55/100 (D) down 45 from last week
Exposed Stripe secret key
A live Stripe secret key is sitting in the code your visitors download. Anyone who finds it can read your customers and move money on your account.
The fix: Roll the key in your Stripe dashboard now, then keep the new one on the server only.
Paste this into Lovable, Bolt, Cursor, or Claude Code:
My Stripe secret key is exposed in my frontend code. Move every Stripe call that needs the secret key into a server-side function, read the key from an environment variable, and make sure nothing secret ends up in the browser bundle. Tell me which files you will change before you change them.
Vibe coding security, checked every week
The mistakes AI-built apps ship with most, checked from the outside. No access to your code needed.
Leaked secret keys
Stripe, OpenAI, Anthropic, Supabase, AWS, GitHub and more, found in the code your visitors download.
Exposed private files
Files like .env that should never be public, and source maps that hand out your app's code.
Missing safety settings
The browser protections (security headers) that block common attacks like clickjacking and injected scripts.
Broken or expiring HTTPS
An expired certificate puts a big scary warning in front of every visitor. We warn you two weeks ahead.
Unsafe cookies and sharing
Login cookies without protection, and settings that let any other website read your app's responses.
Email spoofing protection
Whether scammers can send email that looks like it came from your domain.
$19/month
One app. Cancel anytime.
- A full first report, minutes after you subscribe
- A fresh check every week, automatically
- Plain-English explanations, zero jargon
- A copy-paste fix prompt for Lovable, Bolt, Cursor, or Claude Code
- What changed since last week: new, fixed, still open
- Cancel in one click from any email
Questions
Do you need access to my code or my accounts?
No. We only look at what anyone on the internet can already see when they visit your app: the page, the code your visitors download, and public settings. No logins, no passwords, no code access.
Is the check safe for my app?
Yes. It is passive: a handful of normal page loads, once a week. We never try to break in, guess passwords, or put load on your app.
Is this a full security audit?
No, and we will not pretend it is. It catches the most common mistakes AI-built apps ship with, from the outside. It cannot see your database rules or your server code. If something needs hands-on fixing, Unstuck puts a human on it.
Which apps does it work with?
Any public website or web app: Lovable, Bolt, Replit, v0, Bubble, Webflow, Framer, or hand-coded.
What happens when you find something?
You get an email that week with what it is, why it matters in plain English, how to fix it, and a prompt you can paste straight into your AI tool.
Why every week instead of once?
Because your app changes every time you or your AI ship something new, and a one-time check only covers the day you ran it.
How do I cancel?
Every email has a manage link. One click cancels, and your checks keep running until the end of the month you already paid for.
Found something you can’t fix yourself?
Unstuck: a human fixes your AI-built app for $49, within 48 hours or your money back.