For apps built with Lovable, Bolt, Cursor, Replit & v0
Your app looks fine.
Is it leaking?
Most AI-built apps ship with an exposed key or an open database, and nothing looks broken. Paste your link and see what a stranger can see in under a minute. Every problem comes with a prompt your AI can fix it with. Then the owl keeps watching, and tells you the moment something new leaks.
What builders are posting publicly. Not customers or endorsements of Cobalt Owl.
Nothing breaks. That's the problem.
Your AI agent fixes errors fast, sometimes by switching off a protection or pasting a secret key where everyone can download it. The app keeps working. You find out when a customer emails you, or when a $10,000 API bill shows up.
One scan is a snapshot. Your app changes every day.
Every time you ask your AI for a change, it can quietly reopen a hole you already fixed. A clean scan last week says nothing about today. Owl Watch rescans your app every day and after every change we spot, and emails you only when something new shows up.
One-time scan
- Checks your app once
- Clean today, unknown tomorrow
- You remember to scan again
- You find new leaks yourself
Cobalt Owl Watch
- Rescans every day
- Rescans when your app changes
- Email the moment something new leaks
- History of every scan
What a scan looks for
The mistakes AI builders make most often, checked from the outside, the way a stranger sees your app.
From address to fixed in three steps
Paste your link
Your live app, like yourapp.lovable.app or your own domain. Tick the box to confirm it's yours.
Get your score
A score from 0 to 100 and a plain-English list of what a stranger can see. Under a minute.
Paste the fix
Paste each fix prompt into Lovable, Cursor or Claude, then check again until it's green.
We don't just find it. We hand you the fix.
Security tools are written for security engineers. Ours is written for you: what's wrong, why it matters, and the exact prompt to paste. Example data below, in the format your report uses.
Supabase table readable by anyone
Your app ships a public Supabase key, which is normal. Row Level Security is off on this table, so anyone with that key can read every profile.
The profiles table in Supabase is readable by anyone with the anon key. Enable Row Level Security on it and add policies so a signed-in user can only select and update their own row (auth.uid() = id). Show me the SQL and check that nothing in the app breaks.
Built to be careful with your app
Read-only, like a normal visitor. We never ask for passwords or code access. These are the rules the scanner follows.
We request the pages and files any visitor's browser can load. Nothing behind a login.
Found keys show only their first and last characters. We never store a full key.
For open tables we ask the database for a row count. We never download rows.
We keep the host, score and number of issues for 90 days, then delete them.
Email [email protected] and we remove your scans and waitlist entry.
Our security contact is in security.txt.
Pricing
The scan is free. Pay only when you want proof or peace of mind.
Free scan
See where you stand.
- All six check groups
- Score and issue list
- A fix prompt for every issue
Full report
Before launch or a client handoff.
- Everything in Free
- Downloadable PDF report
- A re-scan after you fix
Owl Watch
Your app has real users and keeps changing.
- Daily rescans of one app
- Rescan after changes we detect
- Email when something new leaks
- Scan history
Studio
You build apps for clients.
- Up to 10 apps
- Daily scans
- Reports to share with clients
The $9 Full report is available now: run a free scan, then buy the full report for that scan. Owl Watch and Studio open soon; join the waitlist free and we'll email you when they do. Owl Watch and Studio renew automatically each month until you cancel; cancel online anytime. See subscription and refund terms.
Questions
Is the scan safe for my live app?
Yes. Every check is a normal read request, like a visitor loading your site. We don't submit forms, log in, or send attack payloads.
Do I need to give you my code or passwords?
No. We only look at what's public, the same pages and files any visitor's browser loads. No signup, no code access, no passwords.
Lovable already shows a green security check. Why do I need this?
Because a green check can still mean every row is public. A policy can exist and still let anyone read your data. We test what a stranger actually sees.
Can I scan a site that isn't mine?
No. You must own the site or have permission to test it, and you confirm that before every scan. Scans are rate-limited.
Does a good score mean my app is secure?
No. It means the issues we check for weren't visible from the outside. It isn't a penetration test or a code review.
Which builders does it work with?
Any deployed website. The fix prompts are written for Lovable, Bolt, Cursor and Claude Code, and the database checks matter most for apps on Supabase.
Who runs Cobalt Owl?
Cobalt Owl is operated by Organic Media Buying LLC, a US company.
Find out before a stranger does.
Run a free check now. Want the owl to keep watching? Join the waitlist for Owl Watch: daily rescans and an email when something new leaks.
Check my app free