For people who built an app with AI

Your app is live. And it grows faster than you can keep up with it.

You described the idea, the AI wrote the code, the app works and people already use it. Then something breaks — and it turns out you have to debug code you never wrote. We look at it from the outside and hand you a receipt: what holds, what is broken, and what nobody has checked.

Show me a receipt row Live proof in action

This is you if

“I can't debug it because I didn't write this code” — and every small error turns into an evening of guessing.
Your database keys sit somewhere in the page code and you are not sure whether that is safe.
After every deploy you are not certain that what worked yesterday still works today.

How it works

One check from the outside
We look at the app the way an ordinary visitor does: certificate, availability, public page code, build marker. We break nothing, change nothing, and never step into your code.
A receipt with three states
Every row gets one of three verdicts — holds, broken, not established — and the address of its evidence. There is deliberately no combined score: it would hide exactly what you need to see.
A ready prompt for your AI
Every broken row comes with text you paste into Cursor, Lovable or Claude Code — and your editor fixes it. You do not need a developer of your own for this.
Honest staleness
You deploy — the receipt does not pretend it is still verified. It moves to “awaiting re-check” until we look again. An old receipt that quietly stays green is worse than none.

What a receipt row looks like

These are real rows the check produces — just on a made-up app.

secret-scan:your-app.examplebroken

A Supabase service key was found in the public page code. That key bypasses every access rule on your database: whoever finds it reads and changes all your data.

Ready prompt for your AI editor

A secret was found in my web app's public bundle. Find it in the frontend code, remove it from the client bundle, move every operation that uses it to the server side (API route or edge function), then revoke the key and issue a new one with the provider. Show the diff and explain what is left on the client now.

secret-scan:other-app.examplenot established

A public Supabase key was found — that is normal, it exists to be public. But whether your tables are closed by access rules is something an outside check cannot see. So: not established, not “all good”.

tls:your-app.exampleholds

The domain certificate is valid and not expired as of the check date.

We never quote a found key — not in the report, not in an email. We name the class of the finding and where it is, so the receipt never becomes the second place it leaks.

Live proof, not promises

Before trusting anyone, look at what this system actually does. Both pages are open and working right now.

See the proof in action

Seven records of one cycle: intent, checks, the human decision, the outcome. You can verify the digest yourself in the browser.

Open registry of marks

Marks bound to specific commits — this site included. Move the code and the mark returns to “awaiting re-check” on its own.

What we do not promise

This is a self-assessment against the checks we actually run — not an audit and not a guarantee.
“Not established” is neither “all good” nor “all bad”. It is a named limit: we did not check this, or could not.
There is no combined score. One green dot on top of three different states is exactly what we refuse to produce.
We look from the outside. What is visible only from inside your code an outside check will not see — and it says so plainly instead of staying quiet.

Want a receipt like this for your app?

We are in closed beta and take apps one at a time. There is no standing order channel yet — and we will not draw a button with nobody behind it.

Price: price not established
Order channel: channel not open yet — it will be named separately

What you can do right now

Build your first evidence record

Right in the browser, no sign-up and none of our servers. You see from the inside what a receipt is made of.

This is you if

How it works

One check from the outside

A receipt with three states

A ready prompt for your AI