Lair
Sign in Upload your app

Scans

Security

Keys, access and the things that get an app broken into.

What it looks for

Secret keys sitting in the page where anyone can read them. Typed text put on the page as live code. Saved data trusted without a check. Requests that fail with no message, so the app looks fine while it is not.

For an app with a server: passwords stored in the open, file names that can reach outside their folder, redirects that can send a visitor anywhere.

Each one comes back with the exact line, what goes wrong there in your app's own names, and a fix you can paste.

view-source: drew-budget-buddy.trylair.com
87  const budget = loadBudget();
88  // paid features
89  const OPENAI_KEY = 'sk-proj-JrZS…';
90  const PREMIUM_PASSWORD = 'letmein2026';
91  async function aiTip(text) {
Anyone can read thisRight-click, View source. No sign-in needed.

How a scan goes

1

Pick an app and a level

In Creator Lair, choose the app, the kind of scan and the level: Quick, Polished or Deep.

Step 1: Pick an app and a level
2

The scan runs

About a minute, up to two for big apps. It reads the files, checks the code and writes the fixes. You can leave the page.

Step 2: The scan runs
3

See what it found

A report card first: how many problems, and the biggest ones. Then each problem, with the exact line and what goes wrong there.

Step 3: See what it found
4

Fix it with one paste

Every problem comes with a prompt written for the tool that built the app. Copy it, paste it, mark it fixed.

Step 4: Fix it with one paste
5

Upload the fix

Upload the new version from Creator Lair and the fixed app is live at the same address.

Step 5: Upload the fix

Three levels

  • Quick

    The things most likely to get the app broken into.

    5 to 20 credits, by app size

  • Polished

    A fuller pass before you share the link.

    10 to 30 credits, by app size

  • Deep

    Everything we look at, including passwords, file names and redirects on apps with a server.

    15 to 50 credits, by app size

Questions

My app has no sign-in and no server. Is there anything to find?
Often, yes. A key in the page, text put on the page as live code and a swallowed error are the most common problems in small browser apps.
Who can run a scan?
Pro and Max members. A scan costs credits, and both get credits every month.
Does it fix the app for me?
No. It tells you what to fix and writes the prompt. You paste the prompt into the tool that built the app, then upload the new version.

Scan your app for security

Scan an appAll four scans