A real scan, start to finish
This is the actual tool scanning a project with planted vulnerabilities. The browser scanner gives the same result — without uploading a thing. Watch the whole flow →
0:00
Lovable, Cursor, Bolt and v0 build the app. Preflar simulates its launch — the leaks, the traffic spikes, the failures, the bill — then fixes what breaks. Before a single real user shows up, all in your browser.
They turn a sentence into a working app in minutes. They also leave keys in the code and databases wide open by default. Preflar is the check you run before anyone else finds out.
These aren't theoretical. They're the three ways AI-built apps actually get burned — and each takes one line to cause.
Bots scrape public code around the clock. A single exposed OpenAI or AWS key becomes someone else's $10,000 bill by morning — on your card.
A Firebase rule left on “allow anyone” means a stranger can read — or delete — every user you have. It's the single most common way these apps die.
One push to GitHub and every secret you own is public, permanently. There's no undo — you can rotate keys, but you can't un-leak them.
Preflar builds a working model of your app from its code, then runs it into the future — thousands of users, traffic spikes, server failures, real attack patterns, a database that keeps growing. You watch exactly what breaks, and what it costs, while there's still time to fix it.
This is the actual tool scanning a project with planted vulnerabilities. The browser scanner gives the same result — without uploading a thing. Watch the whole flow →
The mistakes AI tools actually ship — tuned to be precise, so a normal Firebase web key or a safe database call won't trigger a false alarm.
OpenAI, Anthropic, AWS, Stripe, GitHub, Google OAuth, SendGrid and more — keys, tokens, database passwords, and private keys committed to your code.
Firebase/Firestore rules set to allow anyone, and Supabase service-role keys shipped to the browser — the fastest way these apps get wiped.
A secrets file that isn't ignored from upload, a secret hiding in a NEXT_PUBLIC_ variable that ships to every visitor — one push from a public leak.
Code or shell commands built from user input, SQL glued from strings, open CORS, raw-HTML injection, and debug mode left on in production.
Finding the hole is half the job. Preflar writes the fix — and for the issues a machine can safely correct, you don't even copy-paste.
14 files scanned · looking good
allow read, write: if request.auth != null;
Reach an A or B and Preflar issues a verifiable trust badge — a public page and an embeddable mark showing your app passed a real security scan. It links back to the actual result, so no one has to take your word for it.
<a href="preflar.app/verify/your-app">
<img src="preflar.app/badge/your-app.svg"
alt="Preflar — Grade A">
</a>
Most tools want you to upload your whole repo. Preflar reads and scans your files locally, right on this page — nothing is sent anywhere. Only the result summary (your grade and issue counts) is saved to your account, never your source.
Each stage builds on the last. You start free — and you don't get the green light until your app can actually take a punch.
Find every leak and open door, ranked in plain English.
Auto-fix what's safe to fix and hand your app back clean.
Run it into production — traffic, failures, attacks, cost.
Get the deploy pack and the exact steps to go live.
Pro keeps watching and pings you the moment something breaks.
Real security tools exist — they're built for people who already speak the language. Preflar is built for the person who shipped an app and just wants to know it's safe.
Scan, fix, harden and launch — free, forever. Pro keeps watching your app after launch and pings you the moment a new hole appears.
Everything to scan, fix and launch one app.
A guard that never sleeps after you launch.
No. That's the whole point. Every finding is explained like a person would explain it, and the fix is written for you — including a prompt you can hand straight to your AI tool.
Yes. Scanning runs entirely in your browser — your source never leaves your device. Only the result summary (grade and counts) is saved to your account.
No. It's tuned for the specific mistakes AI coding tools make. A normal Firebase web key, a safe parameterized query, or a test fixture won't set it off.
Any stack — Next.js, React, Python, plain HTML. Paste a single file or pick your whole project folder.
Yes — make an account and scan as much as you want. A paid tier is coming for continuous monitoring, but the scanner stays free.
Point it at your app and know exactly where you stand in under a minute.