AI App Crash Test

AI App Crash Test — Security Checker for Vibe-Coded Apps

Built your app with Lovable, Cursor, Bolt, v0 or Replit? Paste the address and in about 30 seconds see leaked API keys, public source maps, open AI endpoints that can burn your bill, missing security headers and how easy your app is to clone. Read-only and non-intrusive — it works on any website.

Open the full Crash Test See plans and prices

Non-intrusive: only reads what any visitor can download. No logins, no load testing, no calls to your AI.

Leaked key scanner

Reads every first-party JavaScript file for OpenAI, Anthropic, Stripe, AWS, GitHub and database admin keys — the most common vibe-coding mistake.

Runaway AI cost check

Flags browsers calling AI providers directly and AI routes that a simple loop could abuse, before someone spends your budget.

Stealability Index

Public source maps, prompts shipped to the browser, readable database layout and a downloadable .git folder — scored from 0 to 100.

What the report contains

{
  "score": 58,
  "grade": "D",
  "stealability": 72,
  "categories": {
    "secrets": 55,
    "clone": 63,
    "cost": 50,
    "headers": 76,
    "reliability": 95
  },
  "top_issue": "OpenAI API key in public JavaScript — sk-pro…x9Q (164 chars)",
  "also": [
    "Source maps are public (3 files)",
    "2 AI endpoints visible in the app",
    "No Content-Security-Policy"
  ]
}

How to test an AI-built app

01
Paste the public address of your app above and run the test.
02
Read the score, the Stealability Index and the two most serious issues — free, no account.
03
Sign in for every issue with its fix, then turn each into a task on your board.
04
Fix, re-test, and add the signed score badge to your README or footer.

AI App Crash Test questions

Is it safe to run on my production app?: Yes. It downloads only what any visitor's browser already downloads, plus three standard leftover paths (.env, .git). It never logs in, never floods your server and never calls your AI endpoints.
Does it only work for vibe-coded apps?: No. It checks any public website or web app, whatever it was built with. AI-generated apps simply tend to have more of these issues.
Is this a penetration test?: No. It is a fast outside-in check of the most common, most expensive mistakes. For a code-level review, connect GitHub or upload a ZIP in the Security Review tool.
How much does it cost?: The public preview is free. Signed-in users get 3 full reports a day free, then 2 credits per report, charged only when the test completes.
Can someone fake the badge?: No. The badge shows only scores signed by our server, with the site name and date.