Questions and answers

A launch checker for apps built with Cursor, Lovable, Bolt, or v0. You paste a public URL. The scan checks for leaked keys, open database tables, security headers, HTTPS, rate limiting, search and sharing tags, mobile setup, and basic speed. You get a score, plain-English findings, and a fix prompt for each one that you can paste into Cursor or your coding tool.

Most scans finish in under 30 seconds. The scan stops itself at 45 seconds and returns what it has. If it had to skip a check, the report says so.

No. It sends ordinary requests, like a browser would. It doesn't submit forms, guess passwords, try paths at random, or send attack payloads. The rate-limit check sends one request to at most two /api/ routes already in your code. The scan never sends a request to your database unless you've proved you own the app. Row contents are never stored.

Only if you're allowed to request it, for example a client's site you're launching. The terms require permission. Live database tests need a one-time ownership proof on the site itself.

On the report, click Prove I own this app. Add a short meta tag to your homepage head, or a tiny file at /.well-known/throttlebird-verify.txt, then publish. We re-check that tag or file on every database test. Unverified scans never send a request to your database.

Free: your score, every critical finding with its fix prompt, and at least the top three findings in full. You see the titles of the rest. $9, one time: every finding and fix prompt for that one scan. Available for 7 days after the scan. $19 a month (Roost): one saved URL, re-scanned whenever your deploy calls a hook or you press "Scan now". Each re-scan shows every finding. Results appear on a private page.

You pay on Stripe's checkout page. For the $9 report, you return to your report with everything unlocked. For Roost, you land on your private Roost page with your deploy hook and token. There's no account or login.

Use the contact form on the contact page. Re-scans stop when the subscription ends.

If a paid scan never produces a report because our service failed, use the contact form on the contact page and we'll refund that charge.

It didn't flag it as a leak. The anon key and the newer publishable key are meant to be in the browser. The report notes the config so you know your app talks to Supabase from the browser. A service_role or sb_secret_ key in your client code is flagged as critical. Once you've proved you own the app, the database test checks whether a stranger can read your tables. If one returns rows, row-level security isn't protecting it. If nothing comes back, nothing is visible to strangers right now.

No. The score covers what a stranger can see without logging in. It doesn't review your permission logic, dependencies, admin checks, or logs. It's not a penetration test or a certification. Problems can be missed, and false alarms are possible.

No. The site must be on the public internet, on port 80 or 443. A public preview URL works. localhost:3000 doesn't.

The report: the final URL, score, short evidence lines, and prompts. Secret keys are cut to a short prefix. Database checks record whether a read worked, not what came back. Reports are deleted after 7 days.