Free App X-ray: a private report on what to fix first in your app
What anyone can see from outside, the first thing to fix and the steps. In your inbox within 1 working day, no access needed.
Checked and written by me, Max Zeshut: building software for almost 10 years, fixing AI-built apps now. About me · LinkedIn
The first thing I'd fix in your app, with the steps
- 1 What already looks fine, and how I checked
- 2 The first thing to fix, step by step
- 3 What only shows from inside
- Free, nothing to pay
- No login or access needed
- The report goes only to you
- Lovable
- Bolt
- Replit
- v0
- Cursor
- Supabase
- Stripe
What I look at
Only what anyone on the internet can already see. I don't need a login, and I don't ask for one.
- Keys in your browser codeSecret keys shipped to every visitor: OpenAI, Stripe, a Supabase service key.
- Your email domainWhether SPF, DKIM and DMARC are set, so sign-up and reset emails don't land in spam.
- HTTPS and one addressCertificate, redirects, and whether www, the builder's address and yours all lead to one place.
- Security headersThe browser settings that stop clickjacking and other page-level tricks.
- What public pages give awayError messages, debug output and data that shows up before anyone signs in.
- Your sign-in pageWhat it tells a stranger: whether an email has an account, how resets work.
Outside only. Nothing touched.
No sign-ins, no break-ins
I don't sign in as anyone, test your database or try to break anything.
Only the site you send
I don't look at any other site, and I don't need a login or ask for one.
Only you see the report
It's a private link sent to you alone. I never publish what I find without your written OK.
Most of the serious problems (who can read which rows, whether payments really unlock access) only show from inside. The X-ray finds the first one I can see from outside; the Launch Check checks all 10 areas with your access.
What happens next
1Within about 15 minutes
A confirmation email
From [email protected]. Reply with anything that worries you about the app.
2Within 1 working day
Your private report
What already looks fine, the first thing to fix with the steps, and what only shows from inside.
3Your call
Fix it, or have it fixed
Fix it yourself with the report's steps, or the Launch Check: all 10 areas checked and the 3 costliest fixed, including this one. No sales calls.
Taking payments or customer data already?
Don't wait for the report: the Launch Check starts as soon as I have access, and the 3 costliest problems are fixed within 48 hours.
- 3 real fixes or your money back
- Customer data stays in your app
- Nothing goes live without your OK