# Throttle Bird

> Launch checker for vibe-coded apps. Paste a public URL. A rule-based scan returns a plain-English fix list, and a prompt for each issue that you can paste into Cursor or your coding tool.

Throttle Bird is a launch checker for apps built with Cursor, Lovable, Bolt, or v0. It is made for people who build apps without a coding background: findings are written in plain English, and each one comes with a prompt they can paste into their app builder to fix it. The public site is https://throttlebird.com. A scan is free, needs no signup, and usually finishes in under 30 seconds.

The scan is passive and rule-based. It does not call a model. It does not exploit vulnerabilities, brute-force paths, submit forms, or send write requests to the scanned site. It refuses localhost, private IPs, and link-local addresses.

## What the scan looks at

- API keys and secrets in the HTML and client JavaScript (Stripe secret keys, OpenAI, Anthropic, Supabase service_role and sb_secret_, GitHub, AWS access key ids, private keys, and similar). Publishable and anon keys are called out as public-by-design.
- Supabase or Firebase config shipped to the browser. Live database read-tests run only after the site owner verifies ownership; unverified scans send no request to the database. Row and document bodies are never stored.
- Security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
- A rate-limit heuristic: one GET to at most two obvious /api/ routes found in the client code, looking for rate-limit headers. Not a load test.
- HTTPS and certificate expiry, protocol, and whether HTTP redirects to HTTPS.
- SEO basics: title, meta description, Open Graph tags, canonical, lang, robots.txt, sitemap.
- Mobile viewport meta tag.
- Rough performance signals: document time, HTML size, render-blocking scripts, compression, Cache-Control.

## Plans

- Free scan: score, every critical finding, and at least the top three findings.
- Full Report: $9 one time, every finding and a fix prompt, kept 7 days.
- Roost (re-scans): $19/month. The same URL is scanned again when a deploy hook fires or you press Scan now.

## Pages

- [Home](https://throttlebird.com/): run a free scan and read what the checker looks for.
- [Pricing](https://throttlebird.com/pricing): free scan, $9 Full Report, $19/month Roost.
- [Launch checks by builder](https://throttlebird.com/check): platform-specific pre-launch checks with fix prompts.
- [Is my Lovable app safe to launch?](https://throttlebird.com/check/lovable): The checks that matter before you share a Lovable app: database access rules, secret keys, sign-up emails, and link previews. With copy-paste fix prompts.
- [Is my Bolt app safe to launch?](https://throttlebird.com/check/bolt): What to check before you share a Bolt.new app: open database rules, secret keys, sign-in, and your bolt.host link. Plain-English steps and fix prompts.
- [Is my Cursor app safe to launch?](https://throttlebird.com/check/cursor): Built your app with Cursor? Check for committed .env files, public keys, open API routes, and database rules before you launch. With fix prompts.
- [Is my v0 app safe to launch?](https://throttlebird.com/check/v0): Before you publish a v0 app: check NEXT_PUBLIC_ keys, open API routes, Supabase rules, and your vercel.app link. Plain-English steps and fix prompts.
- [Is my Replit app safe to launch?](https://throttlebird.com/check/replit): Before you publish a Replit app: Secrets, production settings, login and payment URLs, saved data, and security scans. Plain-English steps and fix prompts.
- [Pre-launch checklist](https://throttlebird.com/checklist): free plain-English checklist for any vibe-coded app, with a printable version.
- [FAQ](https://throttlebird.com/faq): what the scanner will and will not do.
- [Logbook](https://throttlebird.com/blog): plain-English guides to launching vibe-coded apps safely.
- [Sponsors](https://throttlebird.com/sponsors): help keep the free scan free.
- [Contact](https://throttlebird.com/contact): questions, cancellation, and the refund described in the terms.
- [Privacy](https://throttlebird.com/privacy): what a scan stores.
- [Terms](https://throttlebird.com/terms): acceptable use of the scan.

## Logbook

- [Why isn't my vibe-coded app showing up on Google?](https://throttlebird.com/blog/why-is-my-vibe-coded-app-not-on-google): Two out of three live vibe-coded apps we checked had at least one problem that makes Google's job harder. Here's how to check yours and fix the common ones with plain prompts.
- [How to add security headers to your Lovable, Bolt, or Cursor app](https://throttlebird.com/blog/how-to-add-security-headers-to-your-vibe-coded-app): 97% of the live vibe-coded apps we checked were missing basic security headers. Here's what they are, how to check yours in one minute, and the prompt that adds them.
- [What is an exposed API key, and why does it matter?](https://throttlebird.com/blog/what-is-an-exposed-api-key): A plain-English explanation of API keys, which ones are safe to show, which ones aren't, and what to do if yours leaked.
- [We checked 76 live vibe-coded apps. Here's what almost all of them missed.](https://throttlebird.com/blog/we-checked-live-vibe-coded-apps): We ran our free launch check on 76 public apps built with vibe-coding tools. 97% were missing basic browser safety settings. Here's the full breakdown and how to fix each one.
- [Supabase security for non-coders](https://throttlebird.com/blog/supabase-security-for-non-coders): What Supabase is, what Row Level Security means, and how to check that your app's database is locked, explained without jargon.
- [Supabase's October 30 change: why new tables may stop showing up in your app](https://throttlebird.com/blog/supabase-october-30-change-new-tables): From Oct 30, 2026, new Supabase tables stay hidden from your app until you allow access. What changes, who it hits, and prompts to fix it.
- [Is my Lovable app safe to launch?](https://throttlebird.com/blog/is-my-lovable-app-safe-to-launch): A plain-English check you can do in 15 minutes before you share your Lovable app with real people. No coding needed.
- [How to tell if your vibe-coded app is leaking data](https://throttlebird.com/blog/how-to-tell-if-your-app-is-leaking-data): Five simple tests anyone can run to see whether a stranger could read your users' info. No coding knowledge needed.
- [Bolt app launch checklist](https://throttlebird.com/blog/bolt-app-launch-checklist): A step-by-step checklist for launching an app you built with Bolt, written for people who don't code.
- [The ship-day checklist for a vibe-coded app](https://throttlebird.com/blog/ship-day-checklist-for-vibe-coded-apps): A checklist before you share the URL. Secrets, database rules, headers, HTTPS, rate limits, and the tags that make the link look finished.
- [Your client bundle already confessed](https://throttlebird.com/blog/secrets-in-the-client-bundle): NEXT_PUBLIC_ is a publish switch. How Stripe, OpenAI, and AWS keys land in JavaScript every visitor downloads, and how to get them out.
- [The anon key is not the secret](https://throttlebird.com/blog/supabase-anon-key-is-not-the-secret): Supabase anon keys belong in the browser. service_role keys and a policy of USING (true) do not. Which keys belong in the browser, and how to tell if your tables are open.

## Contact

- Email: support@throttlebird.com
- [Contact form](https://throttlebird.com/contact)