Find the holes in your app before someone else does.
Launching something built with AI, or facing a customer's security review or a VAPT audit? We check your code, show every problem at its exact file and line, explain it in plain words, and help you fix it. Built especially for apps made with Cursor, Lovable, Bolt and v0, which often ship with the database open, admin keys in the website, or other people's data one click away.
Lovable apps we checked had at least one serious problem found by Branch HQ: an exposed admin key, a database anyone could read, a function that runs any command on the database, secret keys sent to the browser, or a login secret that falls back to a known value. How we counted. Public GitHub projects made with Lovable, checked in October 2026 (102 found, 94 with code). A serious problem is one where visitor input reaches something dangerous or a real secret is exposed. Each was read by hand before it was counted. We checked the code only: settings changed in the Supabase dashboard, the live app and business-logic flaws are not seen, so some problems will have been missed. No app is named. The count has changed as the checks improved (34, then 33, then 35); we publish the method, not just the number.
What we check
- Your database: Supabase tables without row-level security, rules that let anyone change every row, functions that run any SQL, and Firebase rules open to anyone.
- Your keys: the Supabase admin key, OpenAI or Gemini keys in the website, secrets in
VITE_/NEXT_PUBLIC_settings, passwords written into the code, and keys left anywhere in your project's history. - Your code: SQL and NoSQL injection, visitor input shown unescaped (XSS), commands built from what visitors type, files opened from a name they send, unlocked login cookies, and more, in JavaScript, TypeScript, Python, Java, Go, Ruby, PHP and C#.
- Who can reach what: records anyone can open by changing an ID, admin rights taken from what the browser sends, forms that save whatever is sent, debug pages that leak users, personal data readable by anyone, and server functions that let strangers spend your AI credits.
- The basics: known vulnerabilities in your libraries, whether your tests pass, and whether your live site is up and secure.
How it works
- Send a link to your repository (read-only access is enough) or a zip of the code.
- Within 48 hours you get a report like this sample: every problem with the file, the line and the code, why it matters and what to do. Keys are never shown in full.
- Want it fixed? Each fix arrives as a reviewed change you approve, with a record of what checked it. Nothing touches your app without your yes.
Your code stays yours
- The check runs on our own machine with fixed rules. No AI service reads your code to produce the report, and the same code always gets the same result.
- Your code is deleted when the work is done, and never shared or used for anything else.
- What it does not do: it is not a full penetration test, and it cannot judge your business logic. The report says plainly what was and was not checked.
Pricing
Launch review
- We run the full review on your code
- Your report: every problem, its line, what to do
- A 30-minute call on what matters most and in what order
- Want us to fix them? Quoted after the report, each fix checked again
Pre-audit review
- Everything in the launch review
- A client-ready PDF report you can share with your customer
- Guidance on every fix, then a re-check that shows them fixed
- Your security answers checked against your code, like this
Building apps for clients? Every client app checked before handover, from ₹30,000 a month. Ask about the agency plan.
Prefer to check it yourself? The Health Check in the free Branch HQ app runs on your own computer, with no AI key, and your code never leaves it.
Tell us what you need
We reply within a day with a fixed price for your app. Prices depend on the size of the code and how soon you need it; nothing is charged until you agree.
Pay by UPI, bank transfer or card, with an invoice, once you have agreed the price. The first three customers on the pre-audit review get the founding price in return for honest feedback and permission to name them. See a sample report.
The sample report is from a small demo app we made with the mistakes AI app builders most often ship with; every key in it is fake.