Is your Lovable, Replit or Bolt app safe to launch? Why I built a free check with no sign-up, no card and a real person to email.
Most of what’s said about scanning AI-built apps is aimed at developers: check every change, watch every push. If you write code for a living, that’s sound advice. The same kinds of mistakes keep slipping in when an AI writes the code: keys left in files, routes anyone can call, packages with known holes. Catching them early matters.
But I want to talk about the person who isn’t a developer, because that was me.
I’d built real apps with AI tools like Lovable and Replit, apps with real users, logins and payments. Then one day a scan showed me my own database was open to anyone with the link. So I went looking for something to check the rest.
Three things.
It was overwhelming. Pages of findings I couldn’t make sense of, and no idea which one to fix first.
I couldn’t tell who was behind it. Many of the tools I found had no real name and no face. I was about to paste my own app into something I couldn’t tell was genuine, and I wasn’t sure it was safe to trust.
Every click felt like a risk. At each step I wondered whether this was the one that would charge me.
And the ones that called themselves free weren’t always free to read. I tried several scanners for AI-built apps. Some showed me an overview and asked me to sign up for the rest. Others ran the whole analysis and then asked me to sign up before I could see the report. That’s their choice, but after I’d already spent my time on a scan, it felt like a wall.
A number on a screen, even an accurate one, doesn’t tell you what it means or what to do next. A scanner can be right and still leave you more worried than before.
Verilay reads your code and explains it layer by layer in plain English: login, database, API, frontend, settings and the libraries you depend on. Here’s the kind of thing it says. I ran it on OWASP Juice Shop, a shop that is deliberately full of holes so people can practise on it. It found a private key written into the code and put it like this:
A private key is stored in your code. This is the digital equivalent of committing your house keys.
Then it tells you where (lib/insecurity.ts, line 21) and what to do: delete the key, generate a new one, and never keep keys in code.
For the bigger problems, Verilay gives you a prompt to paste into your AI builder. The prompt asks it to look, explain and advise before changing anything, because blindly applying a fix can break working code. Each one is labelled with the part of your app it concerns and, where it clearly applies, the technology involved. Here’s one from that same Juice Shop scan:
DOM-Based XSS via Unescaped User Input · Frontend · Angular
The area always matches the layer the report itself lists the problem under, so a label never contradicts the rest of the page. The technology name comes only from what Verilay found in your own app, so a label is never made up. When a fix doesn’t clearly point at one technology, it shows just the area. You can see the whole thing in the full report.
I tried to answer each of the three.
Anything paid costs money because reading a whole codebase takes a lot more AI, and I’m the one who pays for it. The longer version of this story is on the About page.
Here now: a confidence stamp. If your scan finds no critical issues and gets an A or B, you can list your app in Checked apps. You can then put a dated “Checked by Verilay” stamp on your own site, so visitors can see it’s been looked at. It fades after 90 days, so an old clean scan can’t be shown forever. It’s a confidence stamp, not a security guarantee, and it says so.
Exploring: monitoring. A scan is a snapshot. I’m exploring a way to re-check your app on a schedule, such as daily or weekly. It would email you when something new turns up: a newly found problem in a package you use, an exposed key, or a change in your grade. It would tell you what changed since the last check, naming the specific issues. I already run this on my own four apps. It isn’t built for anyone else yet, nothing is for sale and there is nothing to pay. If you’d use it, tell me on the monitoring page how many apps you’d want watched and what would feel fair. That’s how I’ll decide whether to build it.
I’d rather say it plainly:
If you’re a developer, a tool built for continuous checking is worth having too, and it works well alongside this one. If you’re not, or you work with people who aren’t, start somewhere you can read.
It works with apps built on Lovable, Replit, Bolt, v0, Cursor and others, as long as you can share the code as a public GitHub link or a ZIP. Paste the link into verilay.dev. It usually takes one to three minutes. If anything in the report confuses you, that’s useful to me. Tell me and I’ll make it clearer.