Find what your
AI-built app
left exposed.

Only how you pay. Both unlock exactly the same Pro features. Monthly Pro is $9.99 a month, billed until you cancel. Founder’s Lifetime Pro is a single $99 payment with no subscription, limited to the first 100 completed purchases.

No. URL scanning is read-only. It inspects your app’s public surface and uses bounded requests; it does not change your code or deploy fixes.

The public surface of your live app, from its URL. It reads the page and the JavaScript bundles it loads for exposed secret keys (for example Stripe live secret keys, OpenAI and Anthropic API keys, Supabase secret keys, private keys and database URLs with a password) and for server-only settings in runtime configuration. It checks whether .git, .env, configuration, backup and database files can be downloaded, whether source maps are reachable, and whether robots.txt or the sitemap disclose internal paths. It reviews your Content Security Policy, HSTS, framing protection and CORS headers. If your app ships a Supabase public key, it tries one table read and one storage bucket listing with it, and it asks seven common API paths, such as /api/me, whether they return data without a session.

No. PreflightX is a read-only scan of what anyone can download from your live app, not a penetration test. It sends only GET requests from a short fixed list, within a small request budget. It never signs in, never sends attack payloads, never brute-forces or fuzzes, and never tests the keys it finds against their providers. A penetration test is a deeper, usually human-led assessment that includes logged-in and active testing; PreflightX does not replace one.

Only apps you own or have permission to scan. You must confirm this before starting each scan.

No. Enter your deployed app’s public URL. The current URL scanner needs no plugin or code installation.

Your grade, defense score and top finding at once; every finding, its severity and plain-language explanation once you add your email. A free account adds saved scans, history, and two lifetime verifications.

Exact locations, technical evidence, step-by-step fixes, AI repair prompts, and unlimited verification. Choose Monthly Pro ($9.99/month) or Founder’s Lifetime Pro ($99 one-time). Both unlock the same Pro.

Founder’s Lifetime Pro is a single payment of $99 with no renewals and nothing to cancel. It gives you PreflightX Pro for as long as PreflightX offers Pro, subject to our fair-use terms. Your statutory rights are unaffected. See our Terms and Refund & Cancellation Policy.

Monthly Pro renews every month until you cancel. Our voluntary 14-day money-back guarantee covers your first Monthly payment, in addition to your statutory rights. Cancel anytime to stop future renewals; Pro continues through the current paid period unless law requires otherwise. See our Refund & Cancellation Policy.

Yes, while Lifetime spots are left. In Billing, choose Switch to Lifetime and confirm. You pay $99 once; after Stripe confirms the payment we turn off your Monthly renewal, so you are not charged $9.99 again. The month you already paid for runs to its end.

Open Billing and choose Manage subscription. Cancelling stops future renewals. Pro stays active until the end of the month you paid for; then your account returns to Free, and your saved scans stay.

Credential values are redacted before report display. Anonymous reports show the first finding until you add your email; Free reports show every finding. Both receive titles, severities and plain-language explanations only, with no technical evidence or exact locations. The scanner does not test discovered credentials against their providers.

Deploy your changes, then run another scan. Eligible scan comparisons show what was fixed, what remains, and what is new. Free accounts get two lifetime verifications; Pro supports every deploy.