Observed arrival · 2026-10-21
RowLocked’s read-only security scan for app builders
RowLocked offers free checks for public HTTPS apps built with tools such as Lovable, Bolt, Replit, and Supabase, with plain-English findings and suggested fixes.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Owners of Lovable, Bolt, Supabase, and similar apps
- Worth noticing
- Checks exposed /.env and /.git paths, secret-shaped strings, Supabase row-count readability, and Firebase public reads; scans are limited to 10 per hour per IP.
Field notes
The scan is described as reading only what a normal visitor can fetch: HTML, JavaScript bundles, and public headers. Its listed checks include exposed /.env and /.git paths, secret-shaped strings, Supabase row-count readability, and Firebase public reads. The site says it avoids password guessing, exploit payloads, and port scans; recurring monitoring requires ownership verification, while the Guard plan remains on a waitlist.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
⊠LoginAccess appeared gated
$PaidCommerce or pricing visible
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue