Built your site with AI? See what a stranger can see.
Paste your website address. In about 20 seconds we look at your site from the outside — the way Google, a curious visitor or an attacker would — and check for the mistakes that show up most often in AI-built sites: exposed API keys, public private files, open databases. Every problem comes with the exact sentence to give your AI to fix it.
Check my site
We only read what your site already shows to everyone. We never log in, never attack, and never store any key we find.
Loading your page…
Reading the code your site sends to every visitor…
Looking for keys and passwords in it…
Checking for private files left public…
Checking HTTPS, cookies and protection headers…
This report is from a check of the same page in the last 30 minutes.
One message for your AI. Copy every fix below into a single request, in the right order.
What this check can and can't see. It looks only at what your site shows publicly: the page you entered, the scripts it loads from your domain, and a few well-known private file locations. It can't see your server, your database rules or your admin area, and it doesn't try to break in. A clean result means the common outside-visible mistakes aren't there — not that your site is fully audited.
Questions about a result? Ask Emma → — she builds and guards this site, with AI, the same way you do.
What we check
Secret keys in the code your site sends to browsers (OpenAI, Stripe, AWS, Supabase…)
Private files left public: .env, .git, phpinfo
Your database wired straight into the browser
HTTPS, cookies, protection headers
Readable source code and insecure files
What you get
Plain English, no jargon
Red, yellow, green — what matters first
The exact sentence to give your AI for every fix
One combined request you can paste in one go
What we never do
Try to log in or break in
Query or touch your database
Store or show any key we find
Call your site safe — only what's visible
Security for people who build with AI
Is a website built with AI safe?
It can be — and most are fine. AI builders make the same handful of mistakes over and over, and they're all visible from the outside. In 2025, security firm Escape scanned more than 5,600 public apps built with AI tools and found over 400 exposed secret keys. A separate scan of 1,645 Lovable projects found about 10% with database tables anyone could read. Which also means roughly nine in ten were fine.
The most common mistake: keys in the browser
To make a feature work fast, an AI will sometimes put a secret key — OpenAI, Stripe, your database — straight into the code it sends to visitors' browsers. Anyone can open that code and copy the key. The fix is simple once you know: secret keys live on the server, never in the page.
You don't need to read code to check
Attackers don't read your source code either. They look at what your site exposes. This check does the same thing, honestly and passively, then translates every problem into the request your AI needs to fix it.
What a clean result means
A green result means the common outside-visible mistakes aren't on your site. It's a strong sign, not a full audit. For anything handling payments or personal data, keep your database rules tight and review them with your AI regularly.
Marcus WilliamsCEO & Founder · Corpify mind
Let's skip the intro. What's keeping you up at night?
Built your site with AI? See what a stranger can see.