# rooGBotVC

> rooGBotVC (by rooGBot AI) is a website that runs a passive, read-only check of a live web app's public surface, aimed at apps built with AI tools such as Lovable, Bolt, Cursor, Replit and v0. You paste your app's URL and get a free summary of what it found. A paid full report adds plain-English explanations, evidence and a copy-paste fix prompt for each problem. Live at https://vc.roogbotai.com. No sign-up needed for the free summary.

## What the scan checks

The scan only makes normal HTTP GET requests to: the page you submit, up to 15 of that site's own JavaScript files, a few source maps they point to, /robots.txt, /sitemap.xml, /.env and /.git/config. It sends no attack payloads, does no brute forcing or port scanning, writes nothing, and never queries your database. Private and internal addresses are refused.

- HTTPS: whether the site ends up on HTTPS, and whether http:// redirects to https://
- Security headers: Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy
- Exposed secrets in public JavaScript: keys that look like OpenAI, Anthropic, Stripe/other secret keys (sk_live_, sk_test_, rk_), AWS, GitHub, Slack, SendGrid, Groq, xAI, Hugging Face, Replicate, Google OAuth client secrets and private keys. Found values are shown shortened (redacted), never in full.
- Supabase and Firebase: flags a Supabase service_role or secret (sb_secret_) key in public code; if only the public (anon/publishable) key is found, reminds you to check Row Level Security. Notes a Firebase config so you can check your Security Rules.
- Exposed files: a public /.env file (variable names only are listed, never values), a public /.git folder, public source maps
- Mixed content: http:// files loaded on an HTTPS page
- SEO basics: page title, meta description, Open Graph share tags, canonical link, H1 headings, noindex, robots.txt (including "Disallow: /" for all bots) and sitemap.xml

## Free vs full report

- Free summary: finding titles, severity counts (critical, high, medium, low, info) and the list of checks that passed.
- Full report: each finding's explanation, evidence and a fix prompt you can paste into your AI app builder. Prices: £9 for 1 report, or £29 for a 10-report pack. You pay first, then the full scan runs. Pay once, no subscription. Scans and full reports are deleted automatically 30 days after the scan was first run. Pack codes don't expire.

## Limits

- It checks only what any visitor's browser can see. It cannot see your server code, database rules or private pages.
- It is not a penetration test or a security guarantee.

## Guides

Plain-English guides to what the scan checks. Paths are relative to the site root.

- /guides: index of all guides
- Builders (not affiliated with these companies): /guides/lovable, /guides/bolt, /guides/cursor, /guides/replit, /guides/v0
- /guides/exposed-api-keys: secret API keys in public JavaScript
- /guides/supabase-service-role-key: Supabase service_role or secret key in front-end code, and RLS
- /guides/exposed-env-file: a public /.env file
- /guides/exposed-git-folder: a public /.git folder
- /guides/public-source-maps: public source maps
- /guides/security-headers: missing security headers
- /guides/http-to-https: HTTPS and the http:// to https:// redirect
- /guides/robots-txt-and-sitemap: robots.txt and sitemap.xml