For apps built with AI
Built your app with AI? Let’s check it’s safe to launch.
Paste your GitHub link, your live site, or both. In about a minute you get a plain-English list of what to fix, and the exact words to give your AI to fix it.
Free for public repos and any live site. No sign-up. Private repo? Connect GitHub
From a real report on our demo appFull report
You don’t need to understand it. Claude, Cursor, Lovable or Bolt will make the change.
What you get
Every problem, explained like a friend would.
No jargon walls. Each finding has four parts, ranked from most to least serious. Here’s another one from our demo app.
How it works
Three steps. About a minute.
-
Step 1
Paste your link
Any public GitHub repo. No account needed.
-
Step 2
Holefind reads it carefully
Security scanners go through your code and its history, then our AI reviewer looks hardest at keys, logins, database rules and payments.
-
Step 3
Get your report
Problems ranked by how much they could hurt you, each with a fix.
Free check or full report
Start free. Pay only if you want the lot.
This is exactly how our demo app’s report splits.
Free: shown in full
- CriticalSupabase service-role key hardcoded and shipped to the browser
- CriticalRow-level security disabled on notes and never enabled on profiles
- CriticalStripe webhook accepts unsigned requests, so anyone can upgrade to Pro for free
Free: title and severity. Fix and prompt in the full report
- CriticalDelete notes API has no authentication and trusts a user ID sent by the client
- HighStored XSS: note bodies rendered as raw HTML
- HighOutdated Next.js and React versions with known critical vulnerabilities
- MediumNo production build or start scripts, and no environment variable docs
- MediumDatabase errors silently ignored everywhere
Free check
$0
A quick first check of your riskiest files. Your 3 most serious findings in full, plus the title and severity of the rest it found.
Full report
$25 one-off
A full review that reads all your code. Every finding with its fix and a prompt for your AI. Paid per report. No subscription.
Why Holefind
A second pair of eyes, not another scanner.
Keep using your builder’s own checks. Holefind is the independent review that reads your code and backs every finding with the lines it found.
| Holefind | Your builder’s own scan | Asking your AI | Website scanners | Human audit | |
|---|---|---|---|---|---|
| Works with any AI tool | Lovable, Bolt, Cursor, Replit, v0 and more | Only its own apps | Yes | Yes | Yes |
| Reads your code, not just your live site | All of it, plus its history | Yes | What you point it at | Live site only | Yes |
| Independent, not marking its own work | Independent | Checks its own work | Checks its own work | Independent | Independent |
| Cost | $25 once | Free | Free | Usually monthly | Often thousands |
| Time | Minutes | Seconds | Minutes | Minutes | Days |
How we handle your code
What happens to your code, step by step.
You are trusting us with something private. Here is exactly what happens to it.
-
We make a read-only copy
Just the latest version. We never push, open pull requests or change anything on GitHub.
-
It’s reviewed in a sandbox
Our scanners and AI reviewer read the files in that copy. The reviewer has no shell, can’t run your code and can’t browse the web.
-
Then the copy is deleted
As soon as the review finishes, whether it succeeds or fails. We keep the report, not your code.
- Report links are private and long. We don’t list reports anywhere, and search engines are asked not to index them.
- Private repos, only with your permission. You choose which repos we can read through GitHub, read-only, and you can remove access any time. Connect GitHub
Questions
Fair questions.
Do I need to know how to code?
No. Everything is in plain English, and each fix comes with a prompt you paste into the AI tool you already use.
Is this a full security audit?
No. It’s a fast second opinion that catches the common, costly mistakes in AI-built apps. An AI reviewer can miss things, or flag something that’s fine. If you handle payments or sensitive data at scale, get a human audit too.
Lovable or Bolt already checks my app. Why pay?
Keep using it. But a platform checking its own work tends to pass its own mistakes, and it only covers apps built there. Holefind is an independent second opinion for any AI-built app. It reads the code itself, including your database rules, to see whether they actually keep strangers out, not just whether a rule exists.
Why not just ask my own AI to check it?
You can, and it helps. But an AI asked to find problems will often invent some, or tell you broken code is fine. Every Holefind finding has to point to real lines in your code, and serious ones are re-checked by a second reviewer before they reach your report. We also scan your whole git history for keys you deleted but that are still there, check every package against known vulnerabilities, and look at what your live site actually sends to visitors.
How do I know the report is real, not just “you’re fine”?
Every finding shows the file and lines it is about, so you or your AI can check it. Each report also says how much of your code was read. If a review could not cover enough of it, the report says so and gives no score. See a full sample report.
Is my code safe with you?
We read a copy, never change anything on GitHub, and delete the copy as soon as the review finishes. Private repos are read-only, only the ones you choose, and you can remove access any time. You can try the free check on a public repo first.
What kinds of apps does it work on?
Any code on GitHub. It’s tuned for the stacks AI tools usually produce: Next.js, React, Node, Python, Supabase, Firebase and Stripe.
How long does it take?
Most checks take 40 to 60 seconds. Big repos can take a few minutes. The page updates by itself while you wait.
Can I check a private repo?
Private checks work through GitHub: you choose exactly which repos we may read, and access is read-only. Connect GitHub shows whether they are open yet.
What do I get for $25?
The full report for that one check: a review that reads all your code, with every finding, its fix and a prompt for your AI. The link keeps working, so you can come back to it. It’s a one-off payment, not a subscription. Most scanners charge every month, and a human audit can cost thousands.
What if the check fails?
You’re never charged for a check. You only pay to unlock a finished report. If something goes wrong after you pay, contact us and we’ll sort it out.
Ready when you are.
Free, about a minute, and your code is deleted straight after.
Check my app