You built it in Lovable or Bolt. Stripe goes live this week. We check the eight things that turn a launch into a public incident: open debug URLs, missing frame lock, secrets in the JS bundle, wildcard CORS, payments on a preview domain.
Public https only. We don’t store the page. We never show full secrets.
Your report
Hold
DEV MODE. Polar not connected. Full report unlocked for screenshots.
The part that is worth $19
$19 once. Numbered findings in founder language, and the exact prompt to paste back into Lovable or Bolt.
The same eight every time. We fetch the URL you pasted and the same-origin scripts it loads. Existence checks only. No payloads.
01
TLS / HTTPS
Will browsers show Not secure, or is the live URL encrypted?
02
Frame lock
X-Frame-Options or CSP frame-ancestors. Without them, another site can iframe your checkout.
03
Secrets in the JS bundle
Stripe secret keys, Supabase service_role, long JWTs. Anon keys are expected; we still flag them so you check RLS. Lovable does not turn that on for you.
04
Open paths
/.env, /debug, /health, /api/debug. Bolt will ship with /debug open. We only check that the path exists.
05
CORS
A wildcard origin plus credentials lets any website call your API as the signed-in user.
06
Cookies
Secure, HttpOnly, SameSite. Missing Secure on HTTPS is a launch-killer.
07
Stripe on a preview domain
Stripe.js on lovable.app, bolt.host, or vercel.app. Preview URLs get deleted, stolen, or indexed.
08
Stack fingerprint
Lovable, Bolt, v0, Supabase, Cloudflare. Tells you which prompt to paste. Not a vulnerability.
Price
Free tells you to stop. $19 tells you what to paste.
$19 once. You get the findings in founder language and the exact prompt to paste back into Lovable or Bolt.
Real scan of dm-decoder.lovable.app on 17 Aug 2026. Not your URL. Numbers are not invented.
Example report · 17 Aug 2026
Hold
Not ready to take real customers. Fix the launch-killers before you share this link.
TLS
HTTPS on
https://dm-decoder.lovable.app/
Headers
2 of 4 core headers
CSP · HSTS · frame · nosniff
Stack
Lovable · Cloudflare
Fingerprint only
Issues
1 launch-killer
2 warn · 5 ok
#02Launch-killer
This page can be embedded in another website
There is no X-Frame-Options header and no CSP frame-ancestors rule. Another site can put your app in a hidden iframe and trick someone into clicking Pay or Delete. This is a classic launch-killer for checkout pages.
Add these HTTP response security headers to the production site. Do not change visual design. Set X-Content-Type-Options to nosniff. Set X-Frame-Options to DENY (or SAMEORIGIN if we truly need to iframe ourselves). Set Content-Security-Policy with frame-ancestors 'self' (or 'none') plus a conservative default-src/script-src that still allows our own scripts and any required third parties (Supabase, Stripe) we already use. On HTTPS, set Strict-Transport-Security to max-age=31536000; includeSubDomains. Currently missing: Content-Security-Policy, clickjacking protection (X-Frame-Options or CSP frame-ancestors).
Bolt prompt
Configure response headers for production without changing the UI. X-Content-Type-Options: nosniff. X-Frame-Options: DENY. Content-Security-Policy: include frame-ancestors 'self' and keep existing script sources working (Stripe/Supabase if used). Strict-Transport-Security: max-age=31536000; includeSubDomains. Missing now: Content-Security-Policy, clickjacking protection (X-Frame-Options or CSP frame-ancestors).
#05Warn
Public keys are in the frontend (usually OK)
The page includes tokens that look like JWTs or a Supabase apiKey. The anon/publishable key is meant to be public, but a service_role or Stripe secret key is not. Double-check these are publishable keys only. We never display full values.
public Supabase anon JWT (expected in frontend): eyJ…REDACTED
#06Warn
A debug URL is publicly reachable
A debug path answered with HTTP 200. Debug pages often dump environment names, stack traces, or internal URLs. Turn them off in production. We do not display the body.
