For Lovable, Bolt, Cursor, v0, and Replit

Before you take your first payment: can a stranger spend your OpenAI money?

Burnproof checks your Lovable, Bolt, or Cursor app for leaked keys, open databases, and runaway API costs, the stuff that turns launch week into a surprise bill. Free scan in 60 seconds.

Lovable
Bolt
Cursor
v0
Replit

Coding agents will put a provider key in a client component so the demo works. The browser then downloads that key with the rest of the app. Anyone who can view source can spend it. OpenAI, Anthropic, Gemini, and Stripe bill the account that issued the key, not the person who used it.

See a sample report with a planted fake key, or verify you own the site before a deeper scan.

How the bill happens

The key ships in the bundle
A vibe-coded app often calls the model from the browser. The key that makes the call is sitting in the JavaScript.
A stranger copies it
They do not need an account on your app. View source, or a bot that scrapes public pages, is enough.
The invoice is yours
The provider charges the project that owns the key. Caps are easy to forget, and the usage can land overnight.

What the free scan looks for

Keys that bill you

OpenAI, Anthropic, Gemini, Stripe secret keys, AWS access key ids, and a few other tokens that do not belong in a browser bundle.

Data a stranger can list

A Supabase service_role key is critical. An anon key is normal. If the anon key can list tables, we report the table name and a row count. We do not download rows.

Files that should 404

We request /.env and /.git/config and only say whether they look real. The contents stay on the server that sent them.

Headers and Firebase

Missing security headers, plus a Firebase client config. The config is supposed to be public. The risk is open Security Rules, which we do not probe.

How a scan works

1
You paste a URL you own
We refuse private addresses, localhost, and anything that is not http or https.
2
We read the public files
HTML, a handful of same-origin scripts, response headers, and two well-known paths. Timeouts and size limits apply.
3
You get a score and a prompt
Each issue includes a prompt you can paste into your coding agent. Secret values are masked.

Pricing

Paid plans open a hosted checkout. Burnproof never sees your card number. After the provider confirms payment, the access page unlocks for the email you used.

per URL

Free scan

One public URL. The bill-risk score, every masked finding and its severity, and a fix prompt for Lovable, Bolt, Cursor, v0, or Replit. Those details are not held back for a paid plan.

one time

Launch Check

$24

One time. The access page shows the same four-step checklist for the email you paid with: rotate masked keys, move provider keys off the client, confirm /.env and /.git/config are not public, and run the ownership check. It does not scan a URL, hide the free report, or start a Monitor subscription.

Get Launch Check

per month

Monitor

$12/mo

Save up to 3 app URLs. About once a week, Burnproof scans each one again and records what is new. New findings are emailed to the checkout address from alerts@burnproof.dev after that weekly rescan. The first scan of a URL is a baseline and does not send an alert.

Start Monitor

per month

Agency

$49/mo

Save up to 10 client app URLs. About once a week, Burnproof scans each one again. Each scan has a client-ready report link. The page still says Burnproof; this is not a white-label export. New findings are emailed to the checkout address from alerts@burnproof.dev after that weekly rescan. The first scan of a URL is a baseline and does not send an alert.

Start Agency

14-day no-questions refund.

Loading plans…

Scan only apps you own

Burnproof is for the person who built the app. Do not point it at someone else's product to hunt for keys. The check is passive, and you still need permission.

Terms Privacy FAQ

Before you take your first payment: can a stranger spend your OpenAI money?

How the bill happens

The key ships in the bundle

A stranger copies it

The invoice is yours