Free check for apps built with AI

Is your AI-built app leaking your keys?

You built it fast with Lovable, Bolt, Cursor, Replit or v0. Now check it. Paste your link. We look for leaked keys, open files, weak headers and SEO gaps. You get a free summary in under a minute.

  • Read-only
  • No sign-up
  • We never log in or attack
Example report layout
Scan summary
Sorted by how serious each issue is
Critical API key exposed in public code
High Your .env file is public
Medium No Content-Security-Policy header
Low No sitemap.xml found
Fix prompt (full report)Move every OpenAI call to a server-side function. Read the key from a server-only environment variable…
Example layout of a report. Not a real scan.

Built your app with one of these? We can scan it.

Not affiliated with these companies. We scan your live site, so the builder you used doesn't matter.

ElementsSourcesNetworkExample, not a real key
assets/app-3f9a.js
// The JavaScript your app sends to every visitorimport { renderChat } from "./chat"; const OPENAI_KEY = "sk-proj-EXAMPLE-xxxx-not-a-real-key"; export async function ask(question) {  return fetch("https://api.openai.com/v1/...", {    headers: { Authorization: `Bearer ${OPENAI_KEY}` },
Example of a key left in front-end code, as it looks in the browser's DevTools. The key is made up.
Why it matters

What a stranger can see

  • Anyone can see this. Open any site, press View Source or open DevTools, and the code is right there.
  • Bots look for keys like this. Automated tools search public code for keys they can use.
  • A leaked key can cost you. Someone could run up your bill or get to your data.
Check my app
How it works

Three steps. No jargon.

The free scan tells you what's wrong. The full scan tells you how to fix it.

  1. Paste your link

    Enter the web address of your live app. Tick the box to say it's yours.

  2. Get your free summary

    See how many issues we found, how serious each one is, and what each one is called.

  3. Pay, then get the full scan

    You pay first. Then the full scan runs. You get a plain-English reason and a copy-paste fix prompt for every issue.

What the full report gives you

Your fix, ready to paste

  1. The free scan finds it. You see the problem and how serious it is, like the example key above.
  2. The full report explains it. You get a plain-English reason and a fix prompt for every issue.
  3. You paste the prompt. Copy it into Lovable, Bolt, Cursor or your AI builder, and it does the fix.

This comes with the paid report: £9 for 1 report, or £29 for 10 reports.

Scan my app for free
Example fix promptFrom a full report. The key is made up.
Critical

OpenAI API key exposed in public code

We found what looks like an OpenAI API key in JavaScript that anyone can download from your site. Anyone can copy this key and run up charges on your OpenAI account. Treat it as leaked: make a new key and turn off the old one, even after you fix the code.

  • sk-proj-…-key (35 chars) in example.app/assets/app-3f9a.js
Fix prompt: paste this into your AI builder
In my AI app builder (Lovable, Bolt, Cursor, Replit, v0 or similar):
My OpenAI API key is exposed in my front-end JavaScript.
1. Move every OpenAI call to a server-side function or API route. Read the key from a server-only environment variable.
2. Remove the key from all client-side files and from any env variable that starts with NEXT_PUBLIC_, VITE_ or REACT_APP_ (those get shipped to the browser).
3. Make sure the browser calls my own server/API route, and only the server talks to the outside service.
4. Show me every file you changed.
(I will make a new key in the provider's dashboard and turn off the old one myself.)
What we check

The mistakes AI builders make most

We only look at what your site already shows the public. We use normal page loads, like a browser does.

  • Leaked secret keys

    OpenAI, Stripe live, AWS, GitHub, Supabase service_role and more, in the JavaScript anyone can download.

  • Supabase and Firebase

    We spot your project and public key, then remind you to check RLS or Security Rules. We never touch your data.

  • Security headers

    CSP, HSTS, X-Frame-Options or frame-ancestors, X-Content-Type-Options and Referrer-Policy.

  • HTTPS and redirects

    Does your site use HTTPS? Does http:// move people to https://?

  • Open .env and .git

    We check if /.env or /.git/config can be downloaded. If they can, your secrets are out.

  • Public source maps

    Source maps can hand out your original code. We check the ones your scripts point to.

  • SEO basics

    Title, meta description, share tags, H1, canonical link, robots.txt and sitemap.xml.

  • Mixed content

    Files loaded over plain http:// on an https:// page. These can break or be tampered with.

What we don't do: no hacking, no password guessing, no port scans, and no database queries. This is an automated, surface-level check. It is not a full security audit.

Your app, your idea

Will you steal my idea?

No. Here's exactly what we do.

  • We only see what any visitor sees

    We load your public pages and the JavaScript your site sends to every browser. We also check a few standard files, like robots.txt, and whether /.env or /.git can be opened. We never ask for a login, your code or your repo.

  • We don't change anything

    Every request is a plain read (a GET), like a browser opening a page. We send no forms, no logins and no cookies.

  • Keys are masked

    If we find a key, the report shows only the start and the end, like sk-proj-…-key. We never save the whole key. For an open .env file, we list only the names, never the values.

  • Results are deleted after 30 days

    We save your scan results, not a copy of your pages or code. They are deleted automatically 30 days after the scan.

  • Only people with the link can see your report

    Each report has a long, random link that is very hard to guess. We ask search engines not to list report pages. The full report only opens after it's paid for. Anyone you share the link with can see it, so share it with care.

  • We don't sell your data

    Not your scan, not your email, not anything else.

Want the details? Read our privacy policy.

Compare

rooGBotVC, a developer, or AI on your own?

Each one is good for something different. Here's an honest side-by-side.

rooGBotVC compared with hiring a developer and debugging with AI yourself
QuestionrooGBotVCHiring a developerDebugging with AI yourself
What it costsFree summary. Full report £9 for 1 report, or £29 for 10 reports.Hourly or project rates.Your time, plus any AI credits you use.
How fastThe scan usually takes under a minute.Depends on when they're free.Depends on what you ask and how long it takes.
Do you need to know what to look for?No. We run the same set of checks on every scan.No. That's their job.Mostly yes. The AI checks what you ask it to.
Finds leaked keys in public JavaScript?Yes. We read the JavaScript your live site sends to browsers.Yes, if you ask them to check.It can read your code, but it may not see what your live site really sends.
Paste-ready fix?Yes. The full report has a fix prompt for each issue.They usually make the fix for you.You write your own prompts.
How deep does it go?A surface check of what's public. Not a full audit.Can do deeper work and a full security audit.Depends on you and the tool.

  • rooGBotVC

    What it costs
    Free summary. Full report £9 for 1 report, or £29 for 10 reports.
    How fast
    The scan usually takes under a minute.
    Do you need to know what to look for?
    No. We run the same set of checks on every scan.
    Finds leaked keys in public JavaScript?
    Yes. We read the JavaScript your live site sends to browsers.
    Paste-ready fix?
    Yes. The full report has a fix prompt for each issue.
    How deep does it go?
    A surface check of what's public. Not a full audit.

  • Hiring a developer

    What it costs
    Hourly or project rates.
    How fast
    Depends on when they're free.
    Do you need to know what to look for?
    No. That's their job.
    Finds leaked keys in public JavaScript?
    Yes, if you ask them to check.
    Paste-ready fix?
    They usually make the fix for you.
    How deep does it go?
    Can do deeper work and a full security audit.

  • Debugging with AI yourself

    What it costs
    Your time, plus any AI credits you use.
    How fast
    Depends on what you ask and how long it takes.
    Do you need to know what to look for?
    Mostly yes. The AI checks what you ask it to.
    Finds leaked keys in public JavaScript?
    It can read your code, but it may not see what your live site really sends.
    Paste-ready fix?
    You write your own prompts.
    How deep does it go?
    Depends on you and the tool.

A developer can do deeper work and a full security audit, which we don't. For apps with sensitive data, get a human review too.

Pricing

Simple prices. Pay once.

The summary is always free. Pay only if you want the full scan with fix prompts.

You pay first, then the full scan runsNo subscriptionNo surprise charges

1 report

£9

Unlock the full report for this scan.

  • Full scan runs after you pay
  • Plain-English reason for each issue
  • Copy-paste fix prompt for each issue
Start with a free scan

10 reports

£29

Unlock this report and get a code for 9 more.

  • Full scan runs after you pay
  • Plain-English reason for each issue
  • Copy-paste fix prompt for each issue
  • A code to unlock 9 more reports
Start with a free scan
FAQ

Questions

Is the scan really free?

Yes. The summary is free. It shows how many issues we found, how serious they are, and their names. You only pay if you want the full scan with reasons and fix prompts.

When do I pay?

You pay first. Then the full scan runs. There is no subscription and no surprise charge. If the full scan fails, you can run it again at no extra cost.

Is it safe to scan my site?

Yes. We don't guess passwords, send attacks, scan ports or touch your database. See "Will you steal my idea?" above for exactly what we look at and keep.

What is a fix prompt?

It's a short set of steps you can paste into your AI builder, like Lovable, Bolt, Cursor, Replit or v0. It tells the AI what to change.

Can I scan a site that isn't mine?

Only if you have the owner's permission. You must tick the box to confirm this before each scan.

Is this a full security audit?

No. It's an automated, surface-level check of what is public. It can miss things. A clean result does not mean your app is fully safe. For apps with sensitive data, get a human review too.

Who makes rooGBotVC?

rooGBotVC is made by rooGBot AI, which builds practical AI tools that do useful things.

The rooGBot AI robot owl sitting on a sign that says Practical AI Tools

Check your app before someone else does

It takes under a minute. The summary is free.