Demo report

Launch-readiness scan for example.app

AppSafe prioritizes the issues most likely to hurt a launch, then turns each fix into a prompt you can paste into your AI coding tool.

42/100 security score

3 sample findings shown. Real reports include your actual scan output.

Critical

Stripe secret key found in client-side JavaScript

Exposed Secrets

Launch risk

Anyone can inspect the bundle, steal the key, and make authenticated Stripe API requests.

What to fix

Move the secret key to a server-side environment variable and call Stripe only from an API route.

AI coding prompt

Move my Stripe secret key out of client-side code. Create a server-only API route that reads STRIPE_SECRET_KEY from process.env, and update the frontend to call that API route instead.

High

Missing Content-Security-Policy header

Security Headers

Launch risk

A successful XSS bug would have fewer browser-level limits on what scripts can execute.

What to fix

Add a CSP header that limits scripts, images, frames, and connections to trusted sources.

AI coding prompt

Add a production Content-Security-Policy header to my Next.js app in next.config.ts. Start strict with default-src 'self', script-src 'self', frame-ancestors 'none', and explain any tradeoffs.

Medium

DMARC record is missing

DNS & Email Security

Launch risk

Attackers can spoof email from this domain more easily, which damages customer trust.

What to fix

Add a DMARC TXT record at _dmarc.example.com and monitor reports before moving to reject.

AI coding prompt

Create DNS instructions for adding SPF, DKIM, and DMARC to my app domain. Include a safe starter DMARC policy and the path to move from p=none to p=reject.

Checks performed

A simple summary of what AppSafe checked and the result.

Stripe secret key found in client-side JavaScript

Exposed Secrets

Critical issue

Missing Content-Security-Policy header

Security Headers

High issue

DMARC record is missing

DNS & Email Security

Medium issue

SSL certificate is trusted

SSL/TLS

Passed

Session cookies use the Secure flag

Cookie Security

Passed

HTTP traffic redirects to HTTPS

Redirect Chain

Passed

No mixed HTTP content on HTTPS pages

Browser & Frontend Security

Passed

Scan your app free