Worth checking
Keys in public code
A secret key included in JavaScript can be visible to visitors.
See the checks ↗For apps built with AI
Your app works.
Where are its weak spots?
Find your app’s weak spots before you launch. Start with a simple check, then understand what to review and how to fix it.
✓ Free✓ No account✓ No payment
An observation. A next step.
Fictional sample report
A key may be exposed
A secret pattern in a public file.
Finding · Explanation · PromptData access needs a closer look
Check whether public access is intended.
Finding · Explanation · PromptA connection protection is missing
Understand the risk and the next step.
Finding · Explanation · PromptBuilding with AI? You’re in the right place.
Lovable
Bolt
Replit
Cursor
Claude Code
CodexWhat can go unnoticed
A working app can still leave things exposed.
Examples of things to check in your app’s public resources.
Worth checking
Accessible Supabase tables
Access without an account may be intentional. Check which data is involved.
See the checks ↗Worth checking
Unencrypted connection
A page that stays on HTTP leaves its traffic unencrypted.
See the checks ↗Worth checking
Browser protections
Missing settings deserve a review, even when the app works.
See the checks ↗Worth checking
A page embedded elsewhere
Embedding the app on another site should match your intended use.
See the checks ↗Worth checking
What still needs a check
Private code and cross-user permissions need a separate scope.
See the checks ↗The risk
One exposure can have consequences.
The problem isn’t always visible on screen. That is what we look into.
A service used at your expense
An exposed private key can let someone use your account.
Data with too much access
Information intended for your users may be visible without signing in.
A missing protection
An app can work without some security settings.
Trust put at risk
An exposure can affect the people who use your app.
A precise observation, rather than a feeling of safety.
How exposure happens
What a browser can already see.
An illustrative example. No files from your app are shown here.
public / app.js
const client = createClient(…);
const apiKey =
"[SECRET MASQUÉ / MASKED]";
connect(client);- 01
The page opens
The browser retrieves the public files the app needs.
- 02
Public code is readable
A secret key placed in these files may be exposed.
- 03
The exposure needs review
We flag the pattern and mask the value. We never use the key.
- 04
You know what to review
The report explains the observation and the next action.
How it works
Know what to check. And what to do next.
Start with a URL. Take the instructions to your assistant.
Paste your URL
Start with your app’s public address. No need to know your stack.
Understand the findings
See what is confirmed, what needs review and what was not checked.
Fix with your assistant
Use the report’s instructions, verify the changes and run another limited check.
What we check
A URL doesn’t tell the whole story.
Here is what the public check can observe. Each result explains its limits.
Your first checkLimited public scope
PUBLIC FILES
Secret-key patterns
Searches HTML and selected scripts. Values masked; keys never used.
CONNECTION AND BROWSER
HTTPS / HSTS
Checks the final connection and the browser’s declared HTTPS preference.
Content policy (CSP)
Identifies the header. Its presence does not prove the policy is effective.
Page embedding protection
Observes restrictions on embedding in other pages.
Content handling
Checks for the nosniff protection.
DATA ACCESS
Identified Supabase tables
Checks access metadata using a public key, without downloading rows.
Outside this check: private code, other databases, cross-user permissions and unidentified resources.
A prompt ready to copy
The finding. The risk. The next action.
A fictional example to explain the format. Your diagnostic shows only the observations actually made.
ExampleThe connection isn’t encrypted.
In this example, the page stays on HTTP. Information sent over the connection can be read or changed in transit.
Give this to your AI agent
Check whether my app uses HTTPS. If it stays on HTTP, identify where to configure HTTPS and redirect HTTP traffic. Propose the smallest change that fits my project, without deploying. Explain how to test it in a test environment, check that the app’s features still work and undo the change. Ask for my approval before publishing.
You stay in control.
Review the proposal, test the changes, then run an actual check.
Inside the report
Every result has an explanation.
From the first observation to checking a fix. A fictional example to explain the process.
Understand the weak spots
Observations, with their limits.
- HTTP connection observed
- Potential key to review
- Public access to examine
Run the check again
A new result after an actual check.
- Verify the HTTPS connection
- Search again for the reported pattern
- Review intended public access
Fictional example. Results depend on each check.
The cost
Your options, side by side.
You could hire a pro. Debug with AI. Or start by pasting a link.
Hire a developer
$500+
for a single review
- Days or weeks to arrange
- Another review after changes
Debug it with AI
6+ hours
of your own time
- Know exactly what to ask
- Check the live app’s behavior too
WeakSpot
30 seconds
and your first scan is free
- Issues explained in plain language
- Guided solutions for $9, if you need them
Illustrative costs and time, not quotes: they vary by project. 30 seconds is an estimate. The public check does not replace a full review.
Your access, your data
Check your app. Stay in control.
What we look at. What we leave alone.
Public resources only
The page and selected public scripts. No repository to connect to start.
Secrets stay masked
We flag a pattern without showing its value or trying to use it.
Your app stays unchanged
The check creates no accounts, changes no data and publishes no code.
No rows downloaded
Supabase checks use response metadata only.
Download your report
Download the free check to keep it. Paid delivery and its data are explained in the privacy details.
An explicit scope
The report distinguishes performed checks from checks not performed.
A level of review for each need
Start small. Go deeper when you need to.
The free check and guided fixes are open in beta. Deeper investigation follows.
Express check
Understand the problem.
Free
- Potential secret keys in public files
- Identified data access and connection protections
- Analysis and plain-language explanations in a downloadable report
Check my app
Available · Email required to view results
Guided fixes
Get the solution to fix it.
$9
- Guided solutions for the issues in your free analysis
- Copy correction instructions into your AI agent
- Test the changes, then repeat the limited check
Explore guided fixes
One-time payment · Prompts available after confirmation
AI investigation
A deeper review of your project.
$44
- Code, settings and test app within approved access
- Documented findings, with sensitive details masked
- Correction instructions and a limited follow-up check
Prepare my project
Not available · Checkout not enabled
FAQ
Questions. Answered.
What can you check from a URL?
The check inspects HTML, up to six same-origin public scripts and HTTP settings. It looks for secret-key patterns without using them. If a single Supabase project, a public key and table references are identified in those files, it checks at most two tables using HEAD requests limited to one row, without downloading rows. Public access needs review: it may be intentional. Limits: 12 requests, 512 KB per file, 3 MB total and about 30 seconds. External scripts, oversized files, unidentified tables and cross-user permissions remain outside the check.
How do the plans differ?
The free Express check analyzes accessible public information and explains the issues it finds. Guided fixes at $9 provides the solutions: instructions to copy into your AI agent and steps to verify the fix. AI investigation is intended for deeper work with approved access and scope. The free check and guided fixes are available. Investigation is still in preparation and cannot be purchased.
Does WeakSpot change my code?
No. You copy prompts into your coding assistant. Review its changes, test them in a test environment, then repeat the relevant checks. Current prompts use templates matched to findings, without AI analysis of private code.
What access is needed?
No account is needed for the public check. An investigation may require a selected read-only repository, a test application and test accounts. No connector or secret vault is active here: do not send passwords, tokens or API keys. Reading code and active testing require separate permissions.
How do I prepare a test environment?
Use an independent environment, fictional data and accounts with defined roles. Remove production keys and limit permissions. The procedure depends on your builder and host; the preparation flow does not claim to duplicate your project automatically.
What data is kept?
The check processes public files in memory, without a report database or downloaded table rows. Secrets stay masked. Scanned domains are stored locally for the five-free-project limit. A 24-hour encrypted token lets this tab prepare guided fixes. If you purchase, Stripe processes payment and a temporary encrypted summary; Resend emails the report. See our privacy page for retention and details.
Does a report with no findings mean my app is secure?
No. It means only that no issue was detected in the checks performed. Checks that were not performed are listed separately. No diagnostic guarantees exhaustive detection.
Before you launch
Before you launch, take another look.
Free Express check. No guarantee of exhaustive detection.