Scan it before you ship it.
You built it in an afternoon. Now find out what the AI skipped. Paste your deployed URL and get a launch-readiness grade in about ten seconds — security headers, exposed keys in your HTML and compiled JavaScript, meta tags, social cards, crawlability, and the placeholder tells that make an app look unfinished.
32 CHECKS · NO SIGNUP · WE FETCH YOUR PUBLIC PAGES AND NOTHING ELSE
What the scan covers
Security
The headers that stop the boring, common attacks — HSTS, nosniff, clickjacking, CSP — plus a secret sweep of your HTML and your compiled JS bundles for live Stripe, AWS, Google, OpenAI and Anthropic keys, and Supabase admin JWTs.
Identity
The tells that say “prototype”: a title that still reads Create Next App, no favicon, no meta description, and the builder-platform fingerprints Lovable and friends leave behind.
Reach & speed
What happens when your link is shared or crawled — OG cards that actually load, robots, sitemap, structured data, real 404s — plus compression, page weight and response time.