Paste your app's URL and get an A–F security grade in a minute: leaked API keys, open Supabase tables, public .env files. Each problem comes with a plain-English fix and a prompt for Lovable, Bolt or Cursor. Free tools: API key checker, RLS generator.