Afterprompt

Apps built with Lovable, Bolt, Cursor, v0 or Replit often ship with the same mistakes: a Stripe or OpenAI secret key in the JavaScript every visitor downloads, a Supabase service_role key in the frontend, a .env or .git folder served from the root, or source maps that publish the whole source code. Anyone who opens DevTools can find them, and bots look for them the day an app is shared. Afterprompt checks your live site for these problems. Paste your URL and in about a minute you get an A to F grade, with a plain-English fix for each issue and a prompt you can paste into your AI assistant to fix it. The free scan needs no account and is passive: it only loads what any visitor's browser loads. For apps you keep shipping: - Code ($19/month): a GitHub Action scans every push and pull request for leaked secrets, risky code and vulnerable dependencies, with an AI review of the riskiest changes. - Code + Backend ($49/month): once you prove you own the site, we also check your Supabase or Firebase rules, public storage buckets and what your API returns to visitors without an account, plus weekly monitoring with email alerts. - Audit pass ($15, one time): a week of deep scans before a launch. Your code is scanned in an isolated sandbox with no network access and is never stored. We keep the findings only. What we don't test: logins, what one signed-in user can see of another's data, or business logic. It works on any public website, but it's built for the mistakes AI coding tools make most often.