reddit · SideProject · 09-25 07:50 70 分 ← 返回列表

I kept finding the same holes in AI-built apps, so I built a free scanner that checks your live site the way a stranger would

I audit apps that founders build with Lovable, Bolt, Cursor and Bubble. Every audit starts the same way: before I open any code, I look at the live site from the outside. That first pass keeps turning up the same things: a Supabase table anyone can read with the public key in the page, a Stripe or OpenAI key sitting in the JavaScript, password reset emails going to spam because the domain has no SPF or DKIM. So I automated that pass. It's called LaunchProof. You paste a URL, and in about

五维评分

付费意愿

需求真实度

个人可落地

竞争空间

新鲜度

AI 分析

痛点：AI 建站工具生成的应用常暴露数据库、泄露 API 密钥、邮件/DNS 配置错误，非技术创始人缺少简单的外部安全审计。

目标用户：使用 Lovable、Bolt、Cursor、Bubble 等 AI 建站工具的非技术/独立创始人，以及为这类应用做审计的开发者或机构。

证据："a Supabase table anyone can read with the public key in the page, a Stripe or OpenAI key sitting in the JavaScript, password reset emails going to spam because the domain has no SPF or DKIM." / "The full report is $49 one time. That's how I'm paying for the servers."

变现：免费分数引流，$49 一次性完整报告；后续可做订阅式持续监控、修复服务、或向 AI 建站机构/代理商提供白标报告。

MVP：输入 URL，4 分钟内完成外部扫描：集成 OWASP ZAP/Nuclei、检查公开 Supabase/Firebase 记录、扫描前端 JS 密钥、探测敏感路径、检查 SPF/DKIM/子域，并输出可粘贴回 AI 构建器的修复提示。

竞品：OWASP ZAP、Nuclei、Snyk、Detectify、Probely、Intruder、Aikido Security

摘要：帖子介绍 LaunchProof：作者在审计 Lovable/Bolt/Cursor/Bubble 构建的应用时反复发现公开 Supabase 表、前端泄露 Stripe/OpenAI 密钥、邮件 DNS 未配置等问题。产品已上线，免费给 100 分评分，完整报告 $49 一次性付费，但目前没有用户购买或收入数据验证。