You shipped it with AI.
We check it didn't ship your secrets.
LaunchMedic checks your live app for leaked API keys, publicly readable databases, exposed .env files and broken signup or checkout pages — then gives you a copy-paste prompt to fix each issue in your AI coding tool.
Run your free scan →No card needed. Verify you own the domain, get a full report in about a minute.
What we check
Leaked API keys
We read your public JS bundles the way an attacker would and flag Stripe, OpenAI, Anthropic, AWS, Supabase service_role and 15+ other secrets.
Open Supabase tables
Using only the anon key your site already ships, we count which tables anyone can read. Row counts only — we never read your data.
Exposed .env & .git
Checks whether .env, .git/config and other config files are downloadable from your domain.
SSL & security headers
Certificate expiry, HTTPS redirect, HSTS, CSP, clickjacking and more.
Uptime
Is your homepage up and fast? Know before your users tell you.
“Still works” check
Your signup, login and checkout pages must load without errors — catch AI-edit regressions early.
How it works
1. Paste your URL
Add the app you deployed on Vercel, Netlify, Lovable, Replit or anywhere else.
2. Prove it's yours
Add a DNS TXT record, a meta tag, or a file in /.well-known. We only ever scan verified domains.
3. Fix with one paste
Every finding comes with a prompt you paste into Cursor, Lovable, Bolt or Replit to fix it.
Pricing
1 check
- One full check of one verified app.
- All 6 checks + fix prompts
- Emailed report
5 checks
- Five full checks, use them on any of your apps.
- Save $5 vs five single checks
- Emailed report after every check
Pay per check — no subscription. Checks never expire. Prices in USD, plus sales tax where applicable.
Safe by design
Verified domains only
No verification, no scan. We can't be pointed at someone else's site.
Polite & read-only
~40 requests per scan, rate-limited, clearly identified user agent. We never write, log in, or exploit anything.
We don't keep your secrets
Found keys are masked before they're stored. File contents and database rows are never saved.