Supabase RLS policy checker
Paste your policy SQL and get the common RLS mistakes flagged instantly. Runs entirely in your browser.
Guides
Security guides for AI-built apps
Plain-English guides for founders shipping with Lovable, Bolt, Cursor and Replit. Each one explains a common problem, how to check your own app, and a fix you can paste into your AI coding tool.
Get your app checked by handFree tools
Guides
How to check your Supabase RLS before launch
Find tables with RLS off, test as a stranger and as a second user, and fix the policies AI tools get wrong.
Is your OpenAI API key exposed in your frontend?
Check in five minutes whether your OpenAI, Anthropic or Stripe secret key ships to the browser, then fix it properly.
The pre-launch security checklist for AI-built apps
Twenty things to check before real users sign up or pay, from database rules and keys to AI features and payments.
How to check your Firebase security rules before launch
Find open Firestore, Realtime Database and Storage rules, test them in the Rules Playground, and lock data to each user.
Leaked a secret API key? What to do in the first hour
Leaked a Supabase, OpenAI, Stripe or Firebase secret? Revoke it in the right order, check for misuse and fix the cause.
Before you test anything
Every check in these guides is meant for your own app and your own test accounts. Running them against someone else’s app without written permission is unauthorized access.
For worked examples from intentionally vulnerable lab apps, see the LLM testing notes and lab case studies.
Want a second pair of eyes?
Get your app checked before launch.
The Launch Check covers your database rules, exposed keys, unprotected routes and AI features by hand, with plain-English findings, fixes you can paste into your AI coding tool, and a recheck. $400, fixed price.