Paste the URL of your Lovable, Bolt or Cursor app. A passive scan checks for keys in public JS, public .env/.git, source maps and missing headers. Plain-language fixes. Can't see RLS or server code. First scan free.