Your AI said it
fixed it. Did it?

What it tests

Then it writes the fix. Every problem comes with SQL, or a prompt you paste into the tool that built your app.

Common questions

How is this different from asking Claude or Lovable if my app is secure?

Your assistant can only tell you what it believes about the code it wrote. It cannot test the running app, and it has no way to know whether the change it made actually took effect. This asks your live app directly, the way an outsider would, and reports what came back. It is the difference between someone saying the door is locked and someone trying the handle.

What does this check actually look at?

It depends which of the three you use. The URL scan reads four things that are already public: the JavaScript your site sends every visitor, checked for secret keys; your database, asked for a row as an anonymous visitor to see whether it answers; your security headers; and whether files like .env are being served. Connecting a repository goes much further, reading your code across eight areas: security and access, your database and data model, correctness and error handling, architecture, performance, the frontend, SEO, and how it is deployed and monitored.

Do I need to give you access to my code or my account?

No. You paste the address of your live site and nothing else. There is no login, no repository access and no account. The check reads only what is published to the internet, and nothing is stored.

Is it safe to run on my production site?

Yes. Every check is read-only. It loads your pages and scripts the same way a browser does, and asks your database for a single row the way your own app does. Nothing is written, changed or deleted, and no vulnerability is exploited.

What is the fix prompt and how do I use it?

For each problem found you get a block of plain text written as instructions for an AI coding assistant. Copy it and paste it into Claude Code, Cursor, Lovable or whichever tool built your app, and it will make the change in your codebase. You do not need to understand the fix to apply it, though you should read what the assistant proposes before accepting it.

Why do apps built with Lovable, Bolt or Claude Code fail these checks?

Because the code works, which is what these tools optimise for, while the parts that make it safe are invisible from using the app. Database permissions, server-side validation and keeping keys off the client do not change what you see on screen, so nothing prompts anyone to add them until real customer data is already in there.

What if I have not deployed my app yet?

Connect the repository, or use the audit prompt. Both read the code rather than a running site, so neither needs anything deployed. The prompt is the one to use if you would rather not connect anything: copy it, paste it into Lovable, Bolt, Replit, Cursor or Claude Code, and the assistant that built your app audits its own work and reports back in plain language.

Do I have to connect my GitHub repository?

No. The URL scan and the audit prompt both work without it, and they need nothing from you but an address or a copy and paste. Connecting a repository is the deepest of the three because it reads your migrations and your server code, which is where the problems that matter actually live, and nothing a scan from outside can see will ever reach them.

What can the GitHub app see, and how do I remove it?

Only the repositories you pick, and only to read them. You choose them during install and can change that list or uninstall entirely from your GitHub settings at any time, which takes one click. The app has read access to code and metadata and nothing else: it cannot write, cannot open issues or pull requests, and cannot touch a repository you did not select. Each scan mints a token that lasts a few minutes, reads the files into memory, and drops them. We do not keep your code.

What does the check not cover?

Nothing that needs the app actually running: how your login flow behaves in use, file uploads, and bugs that only appear under real traffic. It does not judge whether your pricing or your business rules are correct, because that is a question about your intent and not your code. Known vulnerabilities in your packages are better handled by GitHub's own Dependabot, which is free. Every report lists what it did not check, so a short report is never mistaken for a clean one.