Before you start
What does Vallit do?
Vallit checks an app that is live on the internet and gives you a report. It scores the app and lists each problem, worst first, with where we saw it, what could happen and how to fix it.
Do I need an account to try it?
No. Enter your app’s address at the top of vallit.net and the check starts at once. You tick that the app is yours, or that its owner asked you to check it.
Without an account the report shows the score and the kind of each finding. Sign up and take the report over to open the details.
Do I need to be technical?
No. Where we have a fix kit, it gives the steps, code for your stack and a way to see that it worked.
You can also copy the fix as one message for the AI builder you made the app with, such as Lovable, Bolt, v0, Cursor or Replit. Or ask our team to fix it.
Which apps can you check?
Any app that is live on the internet at a public address, whichever tool built it. Vallit refuses localhost and private networks.
The code checks read JavaScript and TypeScript in a GitHub repository you connect. The build of a mobile or desktop app is not read.
Do I have to prove the app is mine?
For the first check you tick a box that says the app is yours or its owner asked you to look after it. Vallit does not verify the tick.
To confirm the domain you add one DNS record, which only someone who controls the domain can do.