Question 1

What is AppSafe?

Accepted Answer

AppSafe is a security scanner designed for apps built with AI coding tools. It checks your deployed app for common security risks and gives you plain-language fixes.

Question 2

Is it safe and legal to scan my site?

Accepted Answer

Yes. AppSafe only runs the full scan on sites you've proven you own, via a DNS record, meta tag, or file upload — so you're always testing your own app, with permission. That ownership check is a deliberate trust feature: it's what makes AppSafe safe to use and keeps the scanner from ever being pointed at someone else's site. The quick homepage scan is limited to passive checks of public information (headers, SSL, common misconfigurations) that any browser sees when it loads your page.

Question 3

Why do I need to verify site ownership?

Accepted Answer

To prevent abuse and make sure you only scan sites you own or have permission to test. The full scan goes further than a visitor's browser: it looks for leaked keys in your JavaScript and makes a small number of read-only requests to your Supabase or Firebase APIs, using only the public key your site already ships, to see whether data can be read without logging in. It never writes, changes or deletes anything, and it stores only table and field names, never your data. Verification takes a few minutes via DNS, meta tag or file upload.

Question 4

Will scanning affect my app or its performance?

Accepted Answer

No. A scan is read-only: we fetch your pages, headers and public files much like a normal visitor's browser would. On verified sites we also make a few small read-only requests to your database API (one row at a time, with timeouts and a strict request cap). We never submit forms, create or change data, attempt logins or run exploits, and the traffic is far too light to affect your app's performance.

Question 5

What does the scanner check?

Accepted Answer

The full scan checks security headers, SSL/TLS, exposed API keys in your JavaScript, exposed configuration files (.env, .git), source maps, cookies, DNS and email security, common misconfigurations, and whether your Supabase or Firebase database, storage or functions can be read without logging in. The quick scan on the homepage covers headers, SSL/TLS and common misconfigurations.

Question 6

What are 'AI fix prompts'?

Accepted Answer

Since you build with AI, we give you prompts you can paste into your preferred AI coding tool to fix each issue. For example: 'Add a Content-Security-Policy header to my Next.js app.'

Question 7

Can I use AppSafe from Cursor or Claude Code?

Accepted Answer

Yes. On Pro, Agency and Team you can connect AppSafe's MCP server to Claude Code, Cursor or another MCP client with an API key. Your agent can start a scan of a verified site, read the findings and fix prompts, and recheck a finding after you deploy. There's also a REST API and Markdown and SARIF report exports.

Question 8

Does AppSafe keep monitoring my site after the first scan?

Accepted Answer

On Pro, Agency and Team, yes. Scheduled scans (daily or weekly, or hourly on Team) and re-scans on deploy are compared with the previous scan. You can get alerts by email, Slack, Discord or a signed webhook when a new issue appears, a security header is removed, your TLS certificate is about to expire, or new third-party scripts or subdomains show up. Each issue alerts once. A scan can't prove your app is secure, but it shows you what changed.

Question 9

Is the free plan really free?

Accepted Answer

Yes. During beta, you can run scans for free and see your top findings. Upgrade when you want every finding and every AI fix prompt unlocked.

Question 10

What happens to my scan data?

Accepted Answer

Scan results are saved to your private dashboard so you can track your score over time and re-scan after fixes. Reports stay private unless you create a share link yourself. If you delete your account, your sites, scans, and findings are permanently deleted with it.

Check your AI-built MVP for hidden API keys before you go live

How it works

Sign Up

Verify Ownership

Scan

Every finding comes with a fix prompt

Stripe secret key found in client-side JavaScript

What we scan for

Security Headers

Exposed API Keys

Database & BaaS

SSL/TLS Analysis

Misconfigurations

API & Attack Surface

Frontend Security

AI Fix Prompts

Scan, fix and recheck from your AI coding tool

Know when something changes

New issues and fixes

Headers and certificates

Scripts and subdomains

Alerts where you work

Simple pricing

Free Beta

Pro

Agency

Team

Frequently asked questions

Scan before you ship.