Free · runs in your browser

Is my app safe to launch?

Vibe-coded apps often ship with API keys and database credentials sitting in the JavaScript anyone can download. Launch Check finds them in seconds and gives you a one-page report with plain-English fixes.

Run a check

Paste your built JavaScript or your config files. Nothing leaves your browser.

How do I get my JS bundle?

Open your live site in Chrome, right-click → View page source.
Click each <script src="...js"> link (e.g. /_next/static/chunks/... or /assets/index-*.js).
Select all, copy, and paste here. Or run npm run build and upload the files in dist/ or .next/static/.

What it checks

OpenAI, Anthropic, Stripe secret, AWS, GitHub, Slack, SendGrid, Twilio keys
Supabase service_role keys (bypass all security) vs. safe anon keys
Database URLs with passwords (Postgres, MySQL, MongoDB, Redis)
Firebase databases that need rule checks
Secrets hidden in NEXT_PUBLIC_ / VITE_ variables
Hard-coded passwords and exposed source maps

Coming soon: Launch Check Pro, $19

Paste a URL instead. Milo crawls your live site, tests if your Supabase/Firebase tables are readable without login, checks security headers and open admin routes, and emails a signed PDF report.

FAQ

Is my code uploaded?

No. The free check runs entirely in your browser with JavaScript pattern matching.

Is a clean result a guarantee?

No. It catches the most common leaks. It is not a penetration test. Also check database rules, authentication on API routes, and rate limits.

Why are Supabase anon keys and Firebase web keys fine?

They are designed to be public. Your safety depends on Row Level Security (Supabase) or Security Rules (Firebase) being set correctly.