I audit apps that founders build with Lovable, Bolt, Cursor and Bubble. Every audit starts the same way: before I open any code, I look at the live site from the outside. That first pass keeps turning up the same things: a Supabase table anyone can read with the public key in the page, a Stripe or OpenAI key sitting in the JavaScript, password reset emails going to spam because the domain has no SPF or DKIM. So I automated that pass. It's called LaunchProof. You paste a URL, and in about 4 minutes you get a score out of 100 and a verdict: Ready, Almost or Hold. Under the hood it: runs OWASP ZAP and Nuclei against the live app asks your Supabase/Firebase database for records the way a stranger would scans every script for 31 kinds of leaked keys tries 63 private file paths (.env, .git, database dumps) checks email DNS, lookalike domains, forgotten subdomains, headers, mobile and accessibility Every finding shows where it was found and what it proves. That part is written by code, not an AI, so nothing is invented. The fix comes as code and as a prompt you can paste back into your AI builder. What it doesn't do: it doesn't log in, so anything behind authentication still needs a human. The score is free, no sign-up. The full report is $49 one time. That's how I'm paying for the servers. https://trylaunchproof.com I'd love blunt feedback: anything it misses, false positives, or anything confusing in the result. Please only run it on sites you own.   submitted by   /u/Negative-Tank2221 [link]   [comments]