Question 1

What do you actually check?

Accepted Answer

The public page only. We look for secret keys in the JavaScript and source maps, security headers, HTTPS and the certificate, Supabase or Firebase config sitting in the browser, title and social tags, robots.txt and a sitemap, how heavy and how slow the page is, and whether a privacy policy and terms are linked. We do not log in, and we do not try to break in.

Question 2

Do you open my database or read customer data?

Accepted Answer

No. If we see a Supabase or Firebase config, we record that it is there and stop. We never send the anon key, the service role key, or a Firebase API key to those services, and we never read rows. A public anon key is normal. An open table is a problem, and checking that properly comes later, only after you prove you own the app.

Question 3

Is this a penetration test or a certificate?

Accepted Answer

Neither. It is a launch checkup: a letter grade and a short list of fixes. It will miss things. It is not a warranty that the app is safe, and it is not legal advice about the Australian Privacy Act.

Question 4

Why do I have to tick a box?

Accepted Answer

You are asking us to fetch a site and read its public files. That is fine for an app you own, or one you are allowed to test. It is not fine for someone else's. The box is how you tell us which one this is. We rate-limit the checkup as well.

Question 5

What happens to secrets you find?

Accepted Answer

We keep a redacted hint, such as the first and last four characters, plus the file name, so you can find it. The full value is not stored in the report. Rotate the key anyway. Scan records are deleted after 30 days.

Question 6

Why do you ask for an email?

Accepted Answer

The grade and the top 3 issues are shown straight away. The rest of the findings are behind the email, so we know where to send the report once mail is switched on. We store the address with the scan. We do not sell it. Checkout for the paid tiers is not live yet.

Question 7

What is the difference between the free scan and the A$29 report?

Accepted Answer

The free scan is the grade and the top 3 issues, then the rest of this checkup if you leave an email. The Launch Report (A$29 once) is the paid version we will sell: every finding, a re-scan, and a Verified badge. The buy buttons are stubs until Stripe is connected.

Question 8

Which builders do the fix prompts work with?

Accepted Answer

Paste them into Lovable, Bolt, Replit, v0 or Cursor. If we can tell which builder made the app, the prompt says so. You still need to read the change before you accept it.

Question 9

Can you scan a page behind a login?

Accepted Answer

Not in this version. We only fetch the public URL, its same-origin scripts, robots.txt, a sitemap and, if needed, the usual privacy and terms addresses. Anything behind an account is out of scope.

Question 10

What do the grades mean?

Accepted Answer

A is ready, B is close, C needs work, D is not yet, and F means hold the launch. A single critical issue, such as a live secret key or a site stuck on HTTP, caps the grade at F. Passing checks do not cancel a leaked key.

Straight answers