See what’s public.
Enter your live app URL. Patch checks the page, up to six same-origin JavaScript files and common database endpoints for signs of exposure.
BY LABCMD / APPLICATION SECURITY
Your app is live.
What else
is public?
Check for exposed keys, public database access and missing browser protections. See the findings, then decide what needs attention.
Free scan · Read-only · No account required
How Patch worksYOUR PUBLIC SURFACE
example.com
ILLUSTRATIVE REPORTF38 / 100
1 critical pattern1 warningNext steps included
01 / EXPOSED CREDENTIAL
A secret reached the browser.A private API key pattern was found in the app’s JavaScript. Visitors can read code delivered to their browser.
Next step
Rotate the key. Move it server-side.
Remove it from the public bundle.
Rotate the key. Move it server-side.
Remove it from the public bundle.
Content Security Policy needs attention
App served over HTTPS
A surface check, with a practical next step.
WHAT PATCH LOOKS ATBrowser codeSupabaseFirebaseHTTPS + CSP
FROM A URL TO A NEXT STEP
Less uncertainty.
A clearer way forward.
You should understand the finding, why it matters and what you can do about it.
Know what to address.
Read findings by severity, with a suggested fix for each. Reviewed Supabase Row-Level Security changes are available on paid plans.
Keep checking.
Your app keeps changing. Pro and Agency add daily scans, scan history and email alerts when new critical exposure appears.
BUILT FOR THE APPS YOU’RE BUILDING
Fast to build.
Worth a closer look.
Whether you build with Lovable, Bolt, Replit or your own stack, a public app can expose more than its interface.
Check your app01 / CLIENT CODE
Secrets belong server-side.
Patch looks for recognizable private keys and tokens in browser-delivered code, then explains when to rotate and move them.
02 / DATA ACCESS
Public app. Private data.
Checks include common Supabase table endpoints and Firebase Realtime Database access. Findings help you review who can reach the data.
03 / BROWSER PROTECTIONS
The basics still matter.
HTTPS and Content Security Policy checks surface gaps in how your app is delivered to the browser.
START SMALL. KEEP WATCH.
Your first scan is free.
Save an app on Free. Add daily monitoring and reviewed Supabase changes when you need them.
DAILY MONITORING
Pro
$29/mo
For the apps you keep improving
- 10 apps
- Daily monitoring
- Scan history
- Reviewed Supabase RLS changes
- Email alerts
Agency
$99/mo
For a growing app portfolio
- 100 apps
- Daily monitoring
- Scan history
- Reviewed Supabase RLS changes
- Email alerts
Supabase changes require a separate review and confirmation for each table. Keys, application code, Firebase rules and access policies stay in your hands. Compare plans →
CLEAR EXPECTATIONS
Know what
you’re checking.
Will a free scan change my app?
No. The public scan reads pages and endpoints; it doesn’t change your code, keys or database configuration. Scan apps you own or have permission to assess.
Does a clean scan mean my app is secure?
A scan is a view of the public surface at that moment. It does not review all of your source code, authenticated workflows or business logic. Use the report alongside testing and a security review.
What can Patch help me change?
On paid plans, connect a detected Supabase project to read its live table settings. You can review and confirm enabling Row-Level Security on one eligible table with no existing policies. Connecting alone changes nothing. Each change is verified afterward; keys, access policies, Firebase rules and application code need your own review.
Do I need Supabase to use Patch?
No. Public scans also check browser code for exposed secrets, detectable Firebase Realtime Database access, HTTPS and Content Security Policy. Reviewed database changes currently support Supabase.
TAKE A LOOK FROM THE OUTSIDE
Know what your app is sharing.
Start with the URL. Leave with a clearer next step.
Scan my app