ai_app_check

app.openkrill/site-check · Verify this server

Checks an app made with an AI app builder (Lovable, Bolt, v0, Replit, Cursor) for leaks and launch readiness. Use it when the user asks "is my Lovable app secure?", "is my Supabase data public?", "which security headers is my app missing?" or "is my app ready to launch?". For any public app it returns 8 security headers with the lines for the detected host, launchList: 20 of 160 launch items read from outside, each pass, fail or warn with a fix (checklist true adds the owner-only items), and shipNaked: 7 pre-launch pages (privacy policy naming each service, liability terms, cookie banner, deletion, refund line at checkout, legal contact, frontend keys) with text to paste. The first call also returns ownership_not_proven with a DNS TXT record or file: once published, the next call adds exposed files (.env, .git), masked keys in its JavaScript, source maps, open Supabase or Firebase data, and backend signals. GET only; database checks read status codes and row counts, never a row's data, and never write. Do not use it beyond the public checks on an app the user does not own, for private addresses, or to scan many sites.