Questions, answered

Rowly is an external security scanner built for vibe coders shipping apps with AI coding tools (Lovable, Bolt, Base44, Replit, Cursor, v0, and similar) - not security engineers. Give it a domain and it scans the way a stranger on the internet would: no login, no invite, no database password. It finds misconfigured databases, leaked secrets, exposed storage buckets, missing security headers, and dozens of other issues across your whole stack, then hands you a plain-English fix you paste straight into your AI coding tool.

Yes, that's exactly what it's built for. Vibe-coded apps ship fast, which is the whole point, but the database and backend underneath often go live with whatever settings the AI tool defaulted to, unreviewed. Rowly checks a vibe-coded app the way a stranger on the internet would - no login, no database password - and flags what's actually exposed: data anyone can read, leaked API keys, open storage buckets, and more, each with a fix you hand straight back to your AI coding tool.

No - never. Every check Rowly runs is either fully unauthenticated (the same requests any visitor's browser makes) or uses your own project's public anon/publishable key, exactly like your app's frontend already does. Rowly never asks for a database password, service-role key, or any admin credential.

You should only scan domains you own or have permission to test. Unverified domains only ever get the look-but-don't-touch checks - plain requests that any visitor's browser already makes, plus public records like DNS and certificate logs. Nothing there writes data or creates accounts. Verifying a domain with a DNS TXT record is you telling us, on the record, that you're allowed to run the deeper tests against it. Full details are in our Terms of Service.

An unverified domain only gets the look-but-don't-touch checks. Verifying ownership - you publish one DNS TXT record we give you, which takes a couple of minutes - lets Rowly stop guessing and actually try things: adding a row to your database, editing and deleting it again, uploading and replacing a file, signing up a test account, and calling your server-side functions. Everything it creates is deleted straight afterwards and your real data is never touched. Note that verification alone isn't enough: active testing needs a paid plan too, so verifying a domain on Free won't switch it on.

One project you can rescan any time, with the full look-but-don't-touch check set: what anyone can read from your database without logging in, leaked API keys and passwords in your public code, downloadable .env or .git files, exposed source code, browsable folders, your HTTPS certificate, your DNS, and the browser protections your site is missing. Every issue comes with a copy-paste fix. Two things Free doesn't include: the checks for your hosting platforms (Vercel, Netlify, AWS, Firebase and friends), and the deeper active tests - those need a paid plan, and the active tests additionally need you to verify your domain.

Two big things. First, Rowly checks your whole stack instead of just your database - Vercel, Netlify, AWS, Firebase, the AI builder you shipped with - plus independent grades from Mozilla Observatory and SSL Labs, a Google Safe Browsing blacklist check, a look through public certificate records for forgotten staging subdomains, and a warning before your domain expires. Second, you can verify your domain to switch on active testing, where Rowly actually tries to write, edit and delete data rather than just telling you it looks possible. On top of that: 3 projects, 3 teammates, automatic scans on a schedule, Slack and email alerts the moment something new appears, and a weekly digest.

Everything in Pro, scaled up for bigger teams: up to 25 team members (vs. 3 on Pro), up to 10 projects tracked (vs. 3 on Pro), audit logs with CSV export, and priority support. Pro+ runs the exact same security checks as Pro - the difference is team and project scale plus the audit trail, not scan depth.

Yes. Manage or cancel your subscription anytime from Dashboard → Billing - it's a self-serve Paddle billing portal, no email required. If you cancel, you keep paid-plan access until the end of your current billing period, then drop to Free automatically.

Supabase and Firebase for your backend; Vercel, Netlify, AWS S3/CloudFront, GitHub Pages, and Cloudflare for hosting; and Lovable, Base44, Bolt.new, and Replit for AI app-builders - detected automatically from response headers, DNS, and public asset fingerprints, no configuration needed. Rowly also runs Mozilla HTTP Observatory and Qualys SSL Labs for hardening/TLS grades, Google Safe Browsing for malware/phishing blacklisting, Certificate Transparency log review (crt.sh) for wildcard certs and forgotten subdomains, and RDAP domain-registration monitoring for expiring or at-risk domains.

Common real findings: Row Level Security disabled or misconfigured on a Supabase table, an S3/Storage bucket that lists its contents publicly, a leaked service-role key or API secret in a JS bundle, an exposed .env or .git folder, missing security headers (CSP, HSTS), permissive CORS, a subdomain vulnerable to takeover, an about-to-expire domain, and a site flagged by Google Safe Browsing.

Rowly spotted that service running on your domain, but your current plan doesn't include its checks yet. That padlock is based on something real Rowly found on your own site - it's not a generic ad. Upgrade to Pro and rescan, and that tab fills in with actual findings.

Every finding comes with a ready-to-paste prompt for your AI coding tool - Lovable, Bolt, Cursor, Replit, v0, whatever you're building with. Copy it in, and your AI tool implements the fix directly. There's no SQL console to open and no dashboard steps to follow by hand.

Yes - each category (and the full report) has a "Fix all" combined AI prompt that bundles every high-confidence finding in that group into one paste, so your AI tool can knock them out in a single pass instead of one at a time.

Billing runs through Paddle, our merchant of record - they handle card payments, taxes, invoicing, and receipts. You'll see charges from Paddle on your statement, not directly from Rowly.

See our Refund policy for the full details on cancellations and refunds.

Rowly stores your scan reports and security-score history so you can track progress over time. Scans against your database use your own public anon key, exactly like your app already does from the browser - Rowly never stores a database password or service-role key.

Some checks call reputable third-party scanners (Mozilla HTTP Observatory, Qualys SSL Labs, Google Safe Browsing), public Certificate Transparency logs (crt.sh), and public domain-registration lookups (RDAP) - these only ever receive your domain's hostname, never page content or credentials, and results are never published to SSL Labs' public results board. Full detail is in our Terms of Service.

Rowly only ever reads data through your own public anon key or plain public HTTP requests - the same access any visitor to your site already has. It never requests elevated credentials, and every active probe (canary writes, auth/RPC tests) only runs after you've explicitly proven domain ownership via DNS TXT record.