Rowly checks your app for the kind of stuff a non security person wouldn't think to look for, and it's cheap for what it does. You just paste in your domain and it tells you plainly what's wrong and how to fix it. Figured I'd share since a lot of us building with AI are in the same boat. It's free to run a check, and Pro is half price until end of month if you want it monitoring ongoing. https://rowly.me