doorknob

Find what's open in your AI-built app.

Paste your live URL. Doorknob checks for leaked keys, open databases and pages that skip login — then hands you a fix you can paste into Lovable, Bolt or Base44.

Scan my app See a sample report
Built for apps made with
  • Lovable
  • Bolt
  • Base44
  • Replit
  • v0

How it works

Three steps.

We only scan apps you prove are yours. Read-only. Nothing gets changed.

  1. Paste your URL

    Your live app and the email where you want the report.

  2. Prove it's yours

    Add a one-line file or a meta tag. No proof, no full scan.

  3. Get the report

    Plain English findings plus a copy-paste fix for your builder.

Sample report

What you'll see.

Fictional app. Real kinds of problems.

Scan · mytodoapp.lovable.appExample
scanned
Oct 27 2026
mode
external, read-only
Open doors3
  • CRIT
    Table profiles readable by anyone

    Row Level Security is off. We read 3 rows to confirm, then stopped.

  • CRIT
    OpenAI key shipped to the browser

    /assets/index.js · sk-proj-••••Qx7. Anyone can use it on your bill.

  • HIGH
    /admin loads without signing in

    The only check runs in the browser.

  • PASS
    HTTPS on · no service_role key found
Fix prompt · Lovable

Turn on Row Level Security for profiles. Move the OpenAI call into an Edge Function that reads the key from secrets. Protect /admin on the server.

Pricing

First scan free.

Paid plans open when Stripe is connected. No card needed for your first scan.

Starterper app
$19/ month
  • Full scan of your live app
  • Email when the report is ready
  • Fix prompts for your builder
Proper app
$39/ month
  • Everything in Starter
  • Re-scan after every publish
  • Email alert when something new opens

Scan my app — free first time

FAQ

Fair questions.

I can't code. Will I understand the report?

Yes. Every finding is written in plain words, with a prompt you can paste straight back into your builder.

Is this legal?

Testing your own app is. That's why you must prove ownership before a full scan, and why we never change your app.

What do you keep?

Your email, app URL and the findings. Not your users' data. Details in the privacy policy.

What if I already used my free scan?

Paid plans ($19 / $39) will unlock more scans once Stripe is connected. Until then, one free full scan per email.