Exposed secrets
Scans your live JavaScript for API keys, tokens and — worst of all — a Supabase service_role key shipped to the browser.
✦ Surface security scan · read-only
Apps shipped with Lovable, Bolt, v0 and Cursor often expose secrets or leave their database open by default. Averiste Scan checks for the most common, most damaging mistakes in under a minute — without touching your data.
Read-only checks · No account needed · You confirm ownership before scanning
Scans your live JavaScript for API keys, tokens and — worst of all — a Supabase service_role key shipped to the browser.
Detects Supabase tables readable by the public key, which means row-level security is off. We read the row count only, never the data.
Looks for .env, .git and production source maps left reachable on your deployed app.
Checks for the security headers that defend against common browser-based attacks, and flags what's missing.
Yes. Every check is read-only — GET and HEAD requests only. We never write, modify, or delete anything, and we never download your users' data. Table checks read the row count, not the rows.
No. You must confirm you own or are authorized to test the target. Scanning apps you don't control may be illegal.
No. This is a surface scan of the most common mistakes. It does not test business logic or multi-user access control. A clean result is a good sign, not a full audit.