AI builders let anyone ship a real app. Nothing in that workflow tells you when the app is leaking data, or quietly running up a database bill.

AppSitter is the watch service for exactly that gap.

FREE URL SCAN, NO ACCOUNT Paste your live URL and see what the outside world can already see: API keys shipped in the JS bundle, database tables that answer anonymous requests, missing security headers, cookie flags, source maps left in production. A few seconds, no sign-up.

DEEP SCAN VIA GITHUB Connect the repo and AppSitter reads your migrations and reconciles row-level security across all of them rather than just the last one, then probes your live database with your public key the way an attacker would. It also checks your dependencies against published advisories, your storage buckets, and your email DNS (SPF/DMARC).

THE OUTPUT IS A FIX, NOT A REPORT Every finding arrives in plain English with a copy-paste prompt written for the builder that produced your app: Lovable, Bolt, v0, Cursor or Replit. It also generates guardrail files (AGENTS.md, Cursor rules, Lovable Knowledge) so your AI stops reintroducing the same class of bug.

IT KEEPS WATCHING Paid tiers add uptime monitoring with email alerts, automatic re-scans when your repo changes, and a monthly health certificate.

Free covers one app and three deep scans a month, and the first fix is free.

Built and run by one engineer with nearly a decade of production DevOps. The product's whole claim is that it only reports what it measured: when it cannot measure something, it says so instead of guessing.