Paste the URL. Get the grade.
One grade for an app built with Lovable, Bolt, v0, Replit, Cursor or Claude Code: security, email, domain, payments, analytics, SEO and error pages, the way an attacker and a customer see it, with the fix for each failure.
Passive checks only: what a browser requests when it opens your site, at most 25 requests, nothing probed. Two free grades a day. Preview URLs work.
What a grade looks like
A fictional app on a platform subdomain, graded from the outside. One live secret key in the JavaScript bundle caps the grade at D; the score alone would be a C. Every row links to the check and its fix.
What we grade that nobody else does
A builder scans its own output and stops at its wall. An uptime monitor pings a URL. The failures that cost real money sit between vendors, and that is where the grade looks.
Not the domain on your business card: the domain your sign-in and receipt emails actually send from. If it has no SPF, DKIM or DMARC, your magic links land in spam and nobody can log in. We find the sender from the DKIM selectors and say so.
Whether the key in the bundle is a secret key, whether production runs on a test key, and, with your own key on your own machine, whether the webhook points at the live domain and subscribes to the events your code handles.
Open signup, minimum password length, OTP expiry, the redirect allow-list, anonymous sign-ins. None of these appear in the code. We read them through the management API with a token that never leaves your machine.
A random path that answers 200 with the home page teaches search engines that every typo is a page and hides every broken link from your monitor. We request one and read the status.
A policy, not just a record: p=, and a rua= address that receives the reports. Without it, anyone can send mail as you and your own mail is treated as suspect.
The registration date from RDAP and whether auto-renew is on. The cheapest outage there is, and the one no code review catches.
Builder to GitHub to host to database to email to payments to DNS. Each vendor checks its own box. The grade is the only place all seven are read together, as one score, in under ten seconds.
Grade, fix, keep it that way
Grade
Paste a URL. Fifty-one passive checks run in seconds. Verify ownership with a DNS record, a meta tag or a well-known file and seven more run. Seven local checks run on your machine with your own keys and never leave it.
Fix, with the kit or your own AI
Every failed check has a page: what it means, how we test it, why it matters, and the fix. The twelve most dangerous fixes are free. Each page ends with a prompt you paste into your coding agent. The Fix Kit adds the full runbook for every class, written for a human and for an AI.
Keep it that way with the monitor
Re-grade on every deploy, uptime every five minutes, alerts when a header, a certificate or a DNS record regresses, a weekly report, and a badge that shows the current grade.
Free to grade. Paid to fix faster and to stay fixed.
$0
Two grades a day per address. Unlimited for a verified project. Every finding, and the free fixes.
Grade a URL$67one time
Ten modules. A human guide and an AI runbook for every class of failure the grader finds. Runbook Pack +$27, Complete $197.
See the kit$15a month
Re-grade on deploy, uptime, regression alerts, weekly report, badge. Solo $15, Builder $39, Agency $99. Opens soon.
Join the listStraight answers
What does the grader request from my site?
What a browser requests when a visitor opens the site: the home page and the first-party assets it references, robots.txt, sitemap.xml, security.txt, one random path for the 404 check, a HEAD on the Open Graph image, plus DNS and TLS lookups. At most 25 requests. Never port scans, credential guessing, row reads or probes for .env or .git on a domain you have not verified. The full list is on the security page.
Is it safe to grade a site I do not own?
Passive checks only, which is what any visitor's browser already does. A site owner can opt out with a TXT record _securealy with the value optout, or a response header X-Securealy: optout. We honor it before any other request.
What does a grade cost?
Nothing. Two grades a day per address without an account, unlimited for a project you have verified. The Fix Kit is $67 and the monitor opens at $15 a month.
Which builders does it work with?
Any. The grade is of the live URL, so it does not matter whether Lovable, Bolt, v0, Replit, Cursor, Claude Code or a person wrote the code. Preview URLs work too.
What do you store?
Verdicts, not bodies. Each check records a status and a short line of evidence. Secrets in evidence are redacted to a prefix. We never store a page body, a bundle or a response.
Is a good grade a guarantee?
No. The grade is the result of a published checklist run at one moment. It finds the classes of failure that have actually taken AI-built apps down. It is not a penetration test and we never warrant that a site is secure.