Type your domain. Rowly looks at your vibe-coded app exactly the way a stranger would - no login, no invite, no database password - and tells you in plain English what they can see, what they can change, and how to fix it.
No account needed. No database password, ever - we only check what's publicly exposed.
Most security tools ask for a database password before they tell you anything. Rowly never does - it only ever looks at what is already reachable from the public internet, the same way an attacker would.
Rowly reads your site's own public homepage and JavaScript to work out what it runs on - Supabase or Firebase, Vercel, Netlify or AWS, and the AI builder you shipped with - then checks each one from the outside. No database password, no agent to install, nothing to add to your code.
Read-only checks run on every plan: data anyone can read without logging in, API keys left in your public code, downloadable .env files, exposed source, weak HTTPS, and email that can be spoofed. Prove you own the domain on a paid plan and Rowly goes further - actually trying to write a row, upload a file or sign up an account, then deleting whatever it created.
Every issue is written in plain English - what it is, and what could actually go wrong - with a button that copies a ready-made fix for Lovable, Bolt, Cursor, Replit or whatever you built with. Paste it in and your AI tool does the work. There is no SQL console to open.
See the full list of checks, compare plans, or read the FAQ.
