Launch-readiness checkup
Is the app you built with AI actually ready to ship?
LaunchVet reads the public page and gives you a letter grade, the issues in plain English, and fix prompts you can paste back into Lovable, Bolt, Replit, v0 or Cursor.
Free scan shows the grade and the top 3 issues. No card. Prices in AUD.
Keys left in the JavaScript
A live Stripe key, a GitHub token or a Supabase service role in the bundle is a public file. We show a redacted hint and a prompt to rotate it. We do not use the key.
A database config, and no rules
The anon key is meant to be public. The policies are not. This version only detects the config. It never queries Supabase or Firebase.
The launch basics, skipped
HTTPS, headers, a title, a share image, and a privacy page. Security tools stop at the first one. A launch is all of them.
How a checkup works
1
Paste the public URL
Tick the box to confirm you own the app, or you're allowed to test it. We won't scan a site you don't name.
2
We read what a visitor can read
The HTML, same-origin scripts, headers, robots.txt and a sitemap. No login, no writes, no database queries.
3
You get a grade and the top 3
Each issue is in plain English, with a fix prompt you can paste into Lovable, Bolt, Replit, v0 or Cursor.
4
Leave an email for the rest
The full list, including what passed, opens after that. Paid checkout is stubbed until Stripe is connected.
What the free scan looks at
Passive and read-only. If you want active checks, such as asking a Supabase table whether it will return rows, that waits until you have proved you own the app. It is not in this version.
Secrets in the bundle
Live keys, private keys and source maps in the JavaScript a browser can download. Values are redacted.
Headers and HTTPS
HSTS, content security policy, clickjacking, the certificate, and whether HTTP is still open.
Supabase and Firebase
We notice a public config. We do not connect, and we do not read a single row.
Search and sharing
Title, description, Open Graph, language, robots.txt and a sitemap.
Weight and speed
A hint about response time, HTML size, script size and compression. Not a lab benchmark.
Privacy and terms
Whether the public page actually links to them. The wording still needs a lawyer.
The pattern is well documented. A 2025 report on Lovable apps, tracked as CVE-2025-48757, found Supabase tables that answered anyone who asked. The Lovable position is that each builder is responsible for their own app. That is the gap LaunchVet sits in, and it is not only a Lovable problem.
Pricing
A one-time report if you do not want another subscription, and a watch plan if you do. The free scan is the way in.
Prices are in Australian dollars. US amounts are approximate, at A$1 ≈ US$0.66, and are only there for comparison. Paid checkout is not switched on yet — the buttons explain that, they do not take a card.