Security checks for apps built with AI

You shipped it on Friday. Someone found your database on Saturday.

Doorknob walks around your live app and tries every door, the way a bored stranger with a browser would. It tells you what's open, in plain English, and hands you the exact prompt to paste into your builder to close it. Then it checks again every time you hit Publish.

Get a free scan when we open Early access. Not live yet.

Built for apps made with LovableBoltBase44Replitv0

How it usually goes.

This is the minute.
Nobody notices it.

  1. "Build me a habit tracker with login and a leaderboard."
  2. It works. Honestly, it's good.
  3. Shared it in three group chats.
  4. "Make the leaderboard show everyone's streak."
  5. The AI loosens a table policy so the leaderboard can read all rows. Including the emails.
  6. OpenAI bill email. You don't remember running that much.

Nobody did anything dumb here. The app did exactly what you asked. That's the part that gets people.

The doors we try

  • Open database tablesSupabase or Firebase tables anyone can read or write, because row-level security is off or too loose.
  • Keys in your frontendOpenAI, Stripe, Resend and friends sitting in JavaScript that every visitor downloads.
  • Login that isn't really loginPages and API calls that skip auth if you just ask directly.
  • Admin pages left out/admin, /dashboard, internal routes reachable by guessing.
  • Sign-up that trusts too muchUsers who can make themselves admin, or edit other people's rows.
  • The new stuffWhatever your last AI edit changed. We diff each scan against the previous one.

Each finding comes with what it means for your users, in one or two sentences, and a fix prompt written for the builder you used. If the fix needs you to click something in Supabase, we say which button.

WE ASK FIRST

Rules we hold ourselves to

  1. We only scan apps you can prove are yours, with a DNS record or a small file on the site. No proof, no scan.
  2. When a table is open, we read the minimum needed to show you it's open, and we don't keep the rows.
  3. We don't write, delete or change anything in your app.
  4. A clean report means we didn't find these problems. It doesn't mean the app is perfect, and we won't pretend it does.

Scanning someone else's app without asking is how you end up in a different kind of report. So we don't, and neither can you through us.

Early access

$29 /month, per app

Early price, still being decided. It covers a re-scan after every publish and an alert when something new opens up. The first scan is free.

To be straight with you: the scanner is being built right now. Leave your URL and your app goes in the first batch. When it's your turn, the report lands in your email. No card.

One email when your report is ready. Maybe one more when we launch. That's it.

Fair questions

Doesn't my builder already have a security check?

Some do, and you should use it. Most look at your code. Doorknob pokes the live app from the outside, which is where the actual stranger will be, and it does it again after every publish.

I can't code. Will I understand the report?

That's the point of it. Every finding is written for the person who built the app by talking to it, with a prompt you can paste back in.

Is this legal?

Testing your own app is. That's why we make you prove it's yours before we scan anything.