Pewterkit Check · Security
Free security check for your AI-built app
Find secret keys, published source code and missing browser protections in your live app, in about 30 seconds. Then get the fix written for your builder.
Free scan · pay only for the fixes you pick · See a sample report
Your launch check
Owner confirmed: the deeper Security checks ran on this site.
Run the deeper checks on your site
Show us the site is yours with one of these, then press Check now. We then test your database rules, private files and API settings, reading counts and sizes only.
Option 1, DNS: add a TXT record. Name/Host: Value:
Option 2, a file: publish containing
Every check we ran on your site passed
Your launch basics look ready for customers. Made a big change? Run the check again before you share the link.
Pick the categories you want fixed
Pick the categories you want fixedEvery finding comes with its evidence.
The exact line, header or record we read on your live site. Every check is tested against a broken site and a healthy one before it ships, and you can confirm every fix you buy with a re‑check.
What the security check reads
One free scan covers all six categories; this page puts Security first.
- Secret keys in your public codeStripe secret and restricted keys, OpenAI and Anthropic keys, Supabase service_role keys, AWS, GitHub, Slack and SendGrid tokens, and private keys.
- Your source code, publishedPublic source maps that let anyone read your original code, comments and file names.
- Browser protectionsHSTS, clickjacking protection, nosniff and a referrer policy.
Coming next: Supabase table rules and Firebase rules, checked after you confirm the site is yours.
Why it matters
Anything in your JavaScript is public: every visitor downloads it, and anyone can search it from the browser. AI builders can put a whole integration, secret key included, into front-end code when the project has no server yet. One read of your live site shows whether that happened.
Guides
Plain-English fixes with sources, from Pewterkit Guides.
- Stripe secret key exposed in your frontend code: rotate it, then move it to the server
- OpenAI API key in your React or Vite frontend: rotate it and move calls to a backend
- Supabase service_role key in your frontend bundle: replace it and switch the old key off
- Source maps in production: what they show and how to stop publishing them
- HSTS missing: how to add the Strict-Transport-Security header to your app
- Missing X-Frame-Options: add clickjacking protection with frame-ancestors
All six checks, in the same scan
Pick the categories you want fixed, or take all six. One payment.