# SealMyApp

> SealMyApp is a security service for apps built with AI app builders (Lovable, Bolt, Cursor, Replit, v0). It runs read-only checks against an app the requester has proven they own, explains what it finds, gives copy-paste fixes for the builder they use, and can re-check the app daily.

## What it checks
- Supabase: whether tables or storage buckets can be read with the public anon key (Row Level Security off or too permissive), and whether a service_role key is shipped in frontend JavaScript.
- Firebase: Firestore, Realtime Database and Storage rules that allow unauthenticated reads.
- Secret API keys in the JavaScript bundle (e.g. Stripe secret keys, OpenAI, Anthropic, AWS, Resend, SendGrid, GitHub tokens).
- Publicly reachable files: .env files, .git, database dumps, source maps.
- Admin pages and API routes that respond without authentication.
- Security headers (CSP, HSTS, framing) and CORS misconfiguration (low severity).

## How it works
1. The owner enters their app URL and proves ownership with a DNS TXT record (sealmyapp-verify=<token>) or a file at /.well-known/sealmyapp.txt containing the token.
2. A deterministic, read-only scanner (GET/HEAD only, fixed request budget) checks the app and produces a 0-100 score and findings.
3. The free report shows the score, issue counts by severity and the most serious issue in full.

## Pricing (GBP)
- Free scan: £0 — score, issue counts, one issue in full.
- Fix Pack: £29 one-off per app — every issue, copy-paste fix prompts tailored to the builder, Supabase SQL policies, re-scan to confirm.
- Watchdog: £9 per month per app — daily re-scan and an email alert with a fix prompt if something re-opens.

## Rules
- Only apps the requester owns are scanned (ownership must be verified first).
- No user data from scanned apps is stored: to prove a table is readable at most one row is fetched, only the table and column names are kept, and the row is discarded. Secrets are masked.
- Checks are read-only: nothing is written, deleted or brute-forced.
- Public-by-design keys (Supabase anon key, Firebase web config) are not reported as critical.
- A clean scan is not a guarantee of security.

## Is my app secure? (by builder)
- [Is my Lovable app secure?](https://sealmyapp.com/security/lovable): Your Lovable app can be secure, but it isn't secure by default: Lovable gives you the building blocks (a Supabase-based backend, Secrets and a built-in Security view), and whether your users' data is protected depends on how your tables, policies and keys are set up.
- [Is my Bolt app secure?](https://sealmyapp.com/security/bolt): A Bolt app can be secure, but Bolt doesn't make it secure for you: your data is protected by your database's access rules and by keeping secret keys in server functions, and both are easy to get wrong when an AI writes the code.
- [Is my Cursor app secure?](https://sealmyapp.com/security/cursor): Cursor is a code editor, so whether your app is secure depends on the stack you and Cursor's agent chose and how it's deployed; Cursor doesn't host your app or add a security layer to it.
- [Is my Replit app secure?](https://sealmyapp.com/security/replit): A Replit app can be secure, and Replit gives you useful tools (Secrets, a Security Center and pre-publish scanning), but they can't catch everything: API routes that skip auth checks and keys that leak into the frontend are still yours to fix.
- [Is my v0 app secure?](https://sealmyapp.com/security/v0): A v0 app can be secure, but v0 doesn't add a security layer for you: it generates a Next.js app, and your data is only as safe as your database's access rules and how your environment variables are split between server and browser.

## Free tools
- [Is this key safe to expose?](https://sealmyapp.com/tools/key-checker): paste a key prefix; classifies it as public by design (Supabase anon/publishable, Firebase web API key, Stripe pk_) or secret (Stripe sk_/rk_/whsec_, Supabase service_role/sb_secret_, OpenAI, Anthropic, AWS, GitHub and others) and says what to do. Runs entirely in the browser; nothing is sent.
- [Supabase RLS audit](https://sealmyapp.com/tools/supabase-rls-audit): one read-only SQL query for the Supabase SQL editor listing tables with RLS off, policies using true, tables with no policies, views without security_invoker and public storage buckets, with how to read the results.

## Guides
- [How to check if your Lovable/Supabase app is leaking data](https://sealmyapp.com/guides/check-lovable-supabase-app-leaking-data): A step-by-step check you can do in 15 minutes: find your Supabase keys, see which tables have Row Level Security off, test what an anonymous visitor can read, and spot leaked secret keys.
- [How to enable Row Level Security in Supabase (with copy-paste policies)](https://sealmyapp.com/guides/supabase-row-level-security-policies): Turn on RLS and add the right policies for the common cases — owner-only rows, public read, profiles, teams, insert-only forms and storage — plus the gotchas that quietly re-open your data.
- [Is my Supabase anon key safe to expose? (Yes — here's what actually protects your data)](https://sealmyapp.com/guides/is-supabase-anon-key-safe-to-expose): Yes, the Supabase anon (publishable) key is meant to be public. What protects your data is Row Level Security. Here's how to check and fix it.
- [How to find leaked API keys in your vibe-coded app's JavaScript bundle](https://sealmyapp.com/guides/find-leaked-api-keys-javascript-bundle): Anything in your frontend bundle is public. Here's how to search your Lovable, Bolt, v0 or Cursor app's JavaScript for secret keys — and fix a leak.
- [Firebase security rules for vibe-coded apps: lock down Firestore and Storage](https://sealmyapp.com/guides/firebase-security-rules-vibe-coded-apps): Your Firebase API key is public by design; Security Rules protect your data. Copy-paste Firestore and Storage rules for apps built with AI tools.
- [Lovable security checklist: 12 things to check before you launch](https://sealmyapp.com/guides/lovable-security-checklist-before-launch): A 12-point security checklist for Lovable apps before launch: scans, RLS, secrets, storage, admin pages, auth, payments and re-checking after AI edits.

## FAQ
### What does the scan check?
Whether your Supabase tables or storage can be read with the public anon key (Row Level Security), whether a Supabase service_role key ships in your frontend, open Firebase rules, secret API keys in your JavaScript bundle (Stripe, OpenAI, Anthropic, AWS and others), publicly reachable files such as .env, .git and source maps, admin or API routes that answer without a login, and basic security headers.

### Why do I have to prove I own the app?
We only scan apps you own. Before any scan you add a DNS TXT record or a small file at /.well-known/sealmyapp.txt containing a token we give you. This keeps SealMyApp from being used against other people's apps.

### Will the scan change or break anything?
No. Every check is read-only: we only make GET and HEAD requests, within a strict request budget. We never write, delete, or try to guess passwords.

### Do you keep any of my users' data?
No. If we prove a table is readable, we fetch at most one row to confirm it, keep only the table name and its column names, and discard the row immediately. Secrets we find are masked before anything is stored.

### Is my Supabase anon key a problem?
Not by itself. The anon key and Firebase web config are designed to be public. The problem is what they can access — which is why we test whether your tables actually answer to them, and we don't flag the key itself as critical.

### What's in the Fix Pack?
Every issue from your scan explained in plain English, a copy-paste prompt tailored to the builder you use (Lovable, Bolt, Cursor, Replit, v0 or other), SQL policies for Supabase where relevant, and steps to confirm each fix with a re-scan.

### Does a clean scan mean my app is secure?
No. A clean result means none of our automated checks found a problem. It doesn't replace a full security review, and it can't see logic bugs inside your app.

### Which builders do you support?
Apps made with Lovable, Bolt, Cursor, Replit and v0 — and in practice any web app with a public URL. Fix prompts are tailored to the tool you pick.

## Links
- Home: https://sealmyapp.com/
- Free scan: https://sealmyapp.com/scan
- About: https://sealmyapp.com/about
- Contact: hello@sealmyapp.com
- Operator: Richmond Capital Holdings Ltd t/a SealMyApp (registered in England and Wales, company no. 17137348; Halsey House, 18a Milner Street, London SW3 2PU)