A condition report
for the app you built.

You built it with Lovable, Bolt, v0, Cursor or Replit. Enter the address and we tell you, in plain language, what our checks found and whether it keeps running.

How a check works

VallitFileEditViewWindowHelpexample.org

Vallit · example.org

example.orgWaiting

Waiting for a check to start

Only reads, at most three requests at a time

VallitSign inGet started

Check your app

We look at it from the outside, the way anyone on the internet can, and give you a score in about a minute.

Address of your apphttps://myapp.comI own this app, or its owner asked me to check it.Check my app

No account needed. You see the score and what kind of problems we found; the details open once you sign up and take the report over.

Security & stability report Running

example.org

Checked today by you/Ref 7c1e9a42

Checking your app17 of 17

Checking your app is up212 ms
Checking your security certificate184 ms
Checking security headers96 ms
Checking how your cookies are protected88 ms
Checking for insecure content on secure pages140 ms
Checking whether search engines are kept out61 ms
Reading your app for exposed keys1204 ms
Looking for published configuration files402 ms

This usually takes under a minute. You can leave this page open. The link works later too.

Security & stability report Completed

example.org

Checked today by you/Ref 7c1e9a42

78out of 100Fair

0100

Five things need attention. None of them are urgent.

Open findings Critical 0 High 0 Medium 3 Low 2

Observations5 open, worst first

MediumNo Content Security Policy

What we saw Confirmed

The homepage response carried no content-security-policy header and no equivalent meta tag.

What this means

Your app does not tell browsers which scripts are allowed to run on it. A Content Security Policy is a list of trusted sources.

What could happen

If someone manages to inject code into a page (through a comment field, a URL or a compromised dependency), the browser will run it without question.

How we fix it

We add a Content Security Policy tuned to what your app actually loads, starting in report-only mode so nothing breaks while we verify it.

Request fix

Included in your plan. We work on it and record every step.

MediumYour app can be embedded on any website

MediumBrowsers are not told to always use a secure connection

LowBrowsers may guess file types

LowFull page addresses are shared with other sites

Security & stability report Completed

example.org

Checked today by you/Ref 7c1e9a42

100out of 100Good

0100

Nothing needs attention right now. We will keep checking.

Open findings Critical 0 High 0 Medium 0 Low 0

What changed since the last check

Fixed since

No Content Security Policy
Your app can be embedded on any website
Browsers are not told to always use a secure connection
Browsers may guess file types
Full page addresses are shared with other sites

Observationsnothing open

No findings need fixing in this report.

app.vallit.net

Shipping is easy now. Knowing what you exposed is not.

Your source code, public on the web.
Your payment key, readable in the browser.
A database anyone can read.
Strangers using your AI on your bill.
Customers can choose how much they pay.
Other customers' data, one number away.
Any user can make themselves admin.
A database backup anyone can download.
A login cookie any script can steal.
Anyone can send email as you.
Your app hidden inside a fake page.
A security certificate about to expire.
An app that stopped responding.
More checks join the report as the tools change.

Checks and reports

Paste the address and we read what your app shows to anyone. The report is ready in under a minute, worst first and in plain language.

Learn more

Your workspace Home InboxApps Add app

Good morning.

Enter the address of your app.

Apps

Vallit Copy linkOpen Vallit

Security & stability report Completed

example.org

78out of 100Fair

Five things need attention. None of them are urgent.

What we checked

Does your app answer, and how fast?Clear
Is the certificate valid, trusted and far from expiring?Clear
!Do your pages ask browsers to protect them?Found
Can scripts or other sites read your session cookies?Clear
Do secure pages load anything over an insecure connection?Clear
Are search engines told what they may list?Clear
Are secret keys or passwords in what browsers download?Clear
Can anyone download files like .env or .git?Clear

Observations5 open, worst first

MediumNo Content Security Policy

MediumYour app can be embedded on any website

MediumBrowsers are not told to always use a secure connection

Add an app

We check it now, then every day.

Addresshttps://example.orgName (optional)My app

I own this app, or its owner asked me to look after it.

Add app

Fixes and fix kits

Every finding says what it means, what could happen and how it is fixed. A fix kit gives the steps and the code for your stack. On Care we repair every confirmed finding; on Watch each repair is paid separately.

Learn more

Observations5 open, worst first

MediumNo Content Security PolicyHeaders

MediumYour app can be embedded on any websiteHeaders

MediumBrowsers are not told to always use a secure connectionHeaders

LowBrowsers may guess file typesHeaders

LowFull page addresses are shared with other sitesHeaders

MediumNo Content Security PolicyHeaders

Fix kit

Tell browsers which sources are allowed to run on your pages, starting in report-only mode so nothing breaks while you tune it.

Any stackNext.jsVercelExpressNginxCloudflareApache

next.config.ts

01import type { NextConfig } from 'next'02 03const csp = [04 "default-src 'self'",05 "script-src 'self'",06 "style-src 'self' 'unsafe-inline'",07 "img-src 'self' data: https:",08 "font-src 'self' data:",09 "connect-src 'self'",10 "frame-ancestors 'none'",11 "base-uri 'self'",12].join('; ')

Request fix Fix requestedIncluded in your plan. We do the work and record every step.

Inbox · In progress

No Content Security Policyexample.org · Medium

Fix requestedWe have picked this upBeing fixed now

Monitoring and alerts

The guardian checks every app once a day. With a plan and a confirmed domain it checks every five minutes, and emails you when something breaks.

Learn more

example.org

Guardian

Watched since 21 Sept, 22:04. Round the clock, with alerts.

Uptimechecked 2 min ago · next in 3 min
Certificatechecked 6 h ago · next in 18 h
Header driftchecked 6 h ago · next in 18 h
Full checkchecked 6 h ago · next in 18 h

TodayFixed since the last check on 22 Sept: No Content Security Policy.

1 d agoThe guardian ran its first full check of example.org: 78 out of 100.

How it is doing

Health score

84/ 100

From the latest report; 85 and above is healthy

Last 24 hours drawn · 100 % up over 7 days

Uptime, 7 days100 %

Typical response40 ms

GuardianEvery 5 min

DomainConfirmed

Your first report, in under a minute.

Enter the address of the app you built. The score needs no account. Sign in as its owner and the full report, the fix kits and the daily check are yours.

A condition report for the app you built.

Shipping is easy now. Knowing what you exposed is not.

Your source code, public on the web.

Your payment key, readable in the browser.

A database anyone can read.

Strangers using your AI on your bill.

Customers can choose how much they pay.

Other customers' data, one number away.

Any user can make themselves admin.

A database backup anyone can download.

A login cookie any script can steal.

Anyone can send email as you.

Your app hidden inside a fake page.

A security certificate about to expire.

An app that stopped responding.

More checks join the report as the tools change.

Checks and reports

Fixes and fix kits

Monitoring and alerts

Your first report, in under a minute.

A condition report
for the app you built.