For apps built with Lovable, Bolt & Cursor

Your vibe-coded app, launch-ready in one PR.

PreflightPR scans your app for leaked keys, Supabase RLS gaps, auth holes, and Stripe webhook mistakes — then opens a pull request with the fixes. You review, you merge, you ship.

Free Preflight at launch. No credit card. No spam.

$ preflight scan my-saas.lovable.app
✖ CRITICAL  Supabase table "profiles" has RLS disabled
✖ CRITICAL  sk_live_… key exposed in client bundle
▲ HIGH      /api/stripe/webhook skips signature check
▲ HIGH      /admin reachable without auth
✔ Opened PR #12: "PreflightPR: fix 4 launch blockers"

7% & 15%

A community audit of 1,764 vibe-coded apps found 7% had wide-open Supabase databases, and 15% of Bolt apps shipped hardcoded API keys.

Source: r/netsec large-scale security audit

What we check before you launch

The mistakes AI builders make most often — and the ones that hurt most in production.

🔑

Leaked API keys

Secrets in your repo, client bundle, or git history — OpenAI, Stripe, Supabase service keys and more.

🛡️

Supabase RLS gaps

Tables with Row Level Security off or policies that let any user read or write everyone's data.

🚪

Auth holes

Unprotected routes and API endpoints, client-only checks, and admin pages anyone can open.

💳

Stripe webhook mistakes

Missing signature verification, test keys in production, and fulfillment that trusts the browser.

1

Connect

Paste your live URL, or install our GitHub App with narrow, repo-scoped permissions.

2

Scan

Proven open-source scanners (gitleaks, semgrep) plus launch-specific checks run against your code and site.

3

Fix PR

An AI agent writes the fixes and opens a pull request. You review every change before anything merges.

Simple, launch-friendly pricing

Start free. Pay only when you want the full report or the fixes.

Free Preflight

$0

Scan your live site and get a launch score.

  • ✓Live-site scan
  • ✓Overall launch score
  • ✓Issue count by severity
  • ✓Fix details locked
Get early access

Launch Report

$29 one-time

Full code + site scan with a prioritized fix list.

  • ✓Everything in Free
  • ✓Repo scan via GitHub App
  • ✓Prioritized fix list
  • ✓Step-by-step remediation
Join waitlist
Most popular

Report + Fix PR

$49 one-time

We don't just find problems — we fix them.

  • ✓Everything in Launch Report
  • ✓Pull request with fixes
  • ✓One re-scan after merge
  • ✓You review before merge
Join waitlist

Continuous

$19 /month

Stay launch-ready as you keep shipping.

  • ✓Checks on every push
  • ✓Fix PRs for new issues
  • ✓Alerts on new leaks
  • ✓Cancel anytime
Join waitlist

FAQ

Which tools do you support?+

Apps built with Lovable, Bolt, Cursor, and similar AI builders — especially Next.js/React frontends with Supabase and Stripe. If your code is on GitHub, we can scan it.

Will you change my code without asking?+

No. Fixes arrive as a pull request. Nothing is merged unless you review and merge it yourself.

What access does the GitHub App need?+

Only the repositories you select, with the minimum permissions needed to read code and open a pull request. You can uninstall it anytime.

Do you store my code?+

Code is processed to run the scan and generate fixes. We don't sell it or use it to train models. Full details will be in our privacy policy at launch.

Is this a full security audit?+

No. PreflightPR is an automated launch check for common, high-impact mistakes. It's not a penetration test or a compliance certification.

When does it launch?+

Soon. Join the waitlist and you'll get early access and launch pricing first.

Ship it without the 2 a.m. incident.

Get early access and launch pricing.