Check the repository behind the AI-built app
An app that looks finished can still contain a committed environment file, a privileged key in browser code or an API route without an ownership check. Export or connect the code to GitHub, then scan the repository you intend to release. The tool reviews source code rather than probing a live website.
Built-in checks and deeper AI review
Free scans include deterministic checks and the supported npm dependency check. Pro or credits enable deeper AI review. The review can flag likely issues across files, but it is not a proof of correctness and does not execute a penetration test.
Fix prompts and reviewable pull requests
Use the report to investigate the named file, copy a fix prompt into your coding tool, or request an AI-assisted fix. Proposed fixes are opened on a separate branch as pull requests. Check the diff, test the affected flow and merge only when you are satisfied.
What the scanner can and cannot see
Scans use a selected repository branch and a bounded set of relevant files. Large repositories may be partially reviewed. Quick Scan First does not audit the complete Git history, inspect your live database policies or run the application in a sandbox.
Frequently asked questions
Can I scan code built with Lovable or Cursor?+
Yes, when the code is available in a GitHub repository that your token can access. Quick Scan First scans that repository; it does not log into the app builder.
Does Free include the AI review?+
Free scans use the built-in checks and supported dependency check. A deeper AI review requires Pro or credits.
Does a clean report prove my app is secure?+
No. Review the scan coverage and findings, test critical flows, and use expert security testing where the risk calls for it.