Free tool · 30 seconds · read-only
Is your AI-built app ready for paying customers?
Paste the public URL of your live Replit, Lovable or Bolt app. Get a launch and security grade, and the exact fixes to paste into your builder.
0/100
What we found
Unlock the exact fixes
Get a copy-paste prompt for each issue, ready for Replit Agent, Lovable or Bolt, plus your results by email.
Your app passed. Show it off.
Add the Ship-Ready badge to your footer. It tells customers you checked.
What the scanner checks
- Uptime and speed: is the app reachable, and how fast does it answer?
- Security headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy.
- Open CORS: does your server let any website call it?
- Dev leftovers: a development banner still showing in production.
- Google basics: page title, meta description, robots.txt and sitemap.xml that return the right files.
Is it safe to run?
Yes. The scan is passive and read-only: it loads what any visitor's browser already sees (your homepage, response headers, robots.txt, sitemap.xml). It never signs in, submits forms, writes data or reads your database. Private and internal addresses are refused.
What your grade means
- A (90–100): Ship-ready on the surface. Run the free deep audit before you scale.
- B–C (60–89): Almost there. Fix the gaps before your next launch post.
- D–F (below 60): Fix before customers arrive. Or let us do it: $49 Deploy Fix, done in 48 hours or refunded.
Go deeper with the Replit Agent security checklist and the Supabase October 30 grants change.