Test mode. Demo apps are local fixtures. GitHub, Supabase, and Stripe stay stubbed until you add credentials.
PsProdseal

Check an app

Free. Deep checks run only after you prove you own the app and log consent. We never change the app from here.

A public URL gets a passive check only: the HTML and JavaScript a browser would load. No database queries.

Or open a demo app

These four apps are fixtures with planted issues. They are not connected to real Supabase or Stripe accounts.

  • Lovable

    Harbor Market

    RLS off, USING (true), service-role key in the bundle, public bucket.

  • Bolt

    Northwind Notes

    OpenAI key in the client, edge function with JWT checks off, admin gate only in React.

  • Next.js

    Fieldnote

    Live Stripe key in client code, unauthenticated admin API, webhook without a signature check.

  • Clean

    Kindred Goods

    Owner-scoped policies, secrets on the server, webhook verified. Should come back quiet.