Example page made by Ghostlaunch. This product doesn't exist yet.
Back to the exampleFor Lovable and Bolt apps on Supabase
Paste your app's URL. Vettly signs up two test users, tries to reach one's data from the other, and probes your login. You get a clear pass/fail and copy-paste fixes.
Just your URL. No code access. We never store user data.
You built something real without ever learning how logins or database permissions work. Now real signups are coming, and nobody can tell you if it's safe.
"Is the login actually secure? Can one person see another person's data?"
"I asked the AI to review it. It found bugs, but did it catch the scary stuff?"
"Every prompt, I worry it quietly broke something that was fine yesterday."
"I keep reading about leaked Supabase tables and wondering if that's me."
No code access, no setup, no security vocabulary required.
That's all Vettly needs. It works on your live Lovable or Bolt app running on Supabase.
It creates its own test accounts, tries to reach one user's data from another, probes the login and looks for exposed keys.
Each issue comes with a plain-English explanation and a prompt you copy into Lovable or Bolt. Then re-run to confirm it's fixed.
It tests how your app behaves, not just how the code reads. That's the difference between guessing and knowing.
Vettly signs up two test accounts, creates data as one, then tries to read, edit and delete it as the other. Every table gets a clear pass or leak.
It tries weak passwords, repeated guesses, reused reset links, sessions after logout and pages that should need sign-in, the same things a poking user would try.
Every finding explains the risk in plain English and gives a prompt written for your builder. Paste it in, then let Vettly confirm the hole is closed.
Re-run the same checks after every change. Because the tests are identical each time, you see exactly what's new instead of a fresh random list.
Vettly is for you if
You built it with Lovable or Bolt on Supabase
Your app has a login and stores user data, and you never learned how auth or database permissions work.
Real signups are coming
You're about to post in r/lovable, share with a waitlist or hand it to your first customers.
You need a verdict, not a code review
You want to know if it's safe, in plain words, and what to paste in to fix it if it isn't.
Not a fit (yet) if
Asking your AI is free but reads code, not behavior. A pentester is thorough but priced for funded teams.
| Criteria | Vettly | Asking your AI | Freelance pentester |
|---|---|---|---|
| Tests the live app, not just the code | Yes | No | Yes |
| Confirms user A can't read user B's data | Yes | No | Yes |
| Same checks every run | Yes | No | Partly |
| Plain-English pass/fail verdict | Yes | Partly | Partly |
| Fixes written as prompts for your builder | Yes | Partly | No |
| Fits a pre-revenue budget | $29 one-time | Free | $500+ |
Start with one full pre-launch scan. Add monthly re-checks if your app keeps changing.
One full check before you share your app with real people.
$29one-time
For apps that change every day. Catch what a new prompt broke.
$19/ month
Prices shown are early access pricing. No charge until your first scan runs.
An AI review reads code and guesses. It gives a different list each time and can't confirm what actually happens. Vettly runs the live app with real test accounts and shows whether user B can really open user A's data. You get a verdict, not a maybe.
Just your app's URL. No code access, no Supabase password, no API keys. Vettly signs up through your app like any new user would.
No. Vettly only creates and uses its own test accounts and the data they create. We never store your real users' data.
At launch, apps built with Lovable or Bolt that use Supabase for login and data. Firebase and other builders aren't supported yet. Tell us what you use when you sign up.
Vettly only acts as its own test users and works on the data those accounts create. You'll see test signups in your user list, which you can delete afterwards.
That's the point. Each finding says what could happen in plain words, like "any signed-in user can read every invoice," and comes with a prompt to paste into your builder.
No tool can promise that. Vettly covers the basics that most often go wrong in AI-built apps: login, cross-user data access and exposed keys. It isn't a substitute for a full professional audit.
Paste your URL, get a clear pass/fail on login and data access, and fix anything that fails before real people sign up.