If you built your app with an AI builder, you already have more free security tools than you probably know about. Most of them only look at one part of the app, though, so it helps to know which tool sees what. Here's the list I'd go through before sharing a launch link, roughly in order. All of these are free.
1. Your builder's own scan (looks from the inside)
Start here, because these are the only tools that can see your project's settings and code.
- Lovable. Opening the Publish dialog runs a quick security scan of your database access rules, dependencies and MCP server exposure. There's also a deeper code scan in the Security view that looks for things like exposed secrets and missing authorization. (Lovable docs)
- Base44. Dashboard → Security → Run Security Scan, on every plan including free. It checks data permissions, exposed secrets and vulnerable code, with a suggested fix for each finding. (Base44 docs)
- Replit. The Project Security Center in the Tools pane scans your code and packages. You can also block publishing when there's a critical finding. (Replit docs)
Fix the critical findings first, and test the app again afterwards. Permission fixes sometimes break a page that logged-out visitors use.
2. Supabase Security Advisor (if your app uses Supabase)
If your data lives in Supabase, open your project dashboard and go to Advisors → Security Advisor. It flags things like tables with row level security turned off. Supabase notes that some findings may be intentional, so check each one against what you meant before changing anything. (Supabase docs)
If row level security is new to you, start with Supabase row level security for beginners. And if you create new tables after October 30, read what changes for new Supabase tables.
3. GitHub secret scanning (if your code is on GitHub)
If your builder syncs to a GitHub repository, GitHub's secret scanning can alert you when a known type of key gets committed. It's free for public repositories. (GitHub docs) If it ever finds a real key, make a new one in that service's dashboard and delete the old one. Deleting the line from your code isn't enough.
4. Outside-in checks of your live site
The tools above look at your project. These look at what your published site actually sends to a stranger's browser, which is what an attacker sees too.
- Mozilla HTTP Observatory checks your security headers and gives you a score with notes on each header. (developer.mozilla.org/observatory)
- Qualys SSL Labs takes a deep look at your HTTPS certificate and settings. It's more detail than most people need, but it's the standard. (ssllabs.com/ssltest)
- Throttle Bird is the free scan I built for this step. Paste your live link and it checks for secret keys sitting in your page or its JavaScript files, security headers, HTTPS, link previews, sitemap and page speed. If your page already exposes its Supabase or Firebase settings, it also runs one read-only test to see whether a stranger can read your tables. It explains every finding in plain English. Run it here.
5. The two checks no tool does for you
- Sign up as a stranger. Use a private window on your phone and an email you've never used. Does the confirmation email arrive, and does its link open your live site?
- Spy on yourself. Make two accounts. Create something as the first one, then log in as the second and try to find it, including by changing an ID in the address bar.
The short version
- Run your builder's scan and fix critical findings.
- If you use Supabase, check the Security Advisor.
- If your code is on GitHub, turn on secret scanning.
- Check your live site from the outside.
- Sign up as a stranger, and test with two accounts.
None of this needs coding knowledge, and all of it together takes less than an hour. For the full pre-launch list, including the non-security parts, see the ship-day checklist.