We audited 190 Lovable and Emergent apps
DevOps Genie™

Free web audit

Audit your app without sending us your code.

Built with Lovable or Emergent? Drop the ZIP from GitHub and offramp checks it for exposed data, leaked keys and platform lock-in, right here in your browser.

Audit your app

Takes under a minute. Free, and nothing to install.

Drop your app's ZIP or folder here

The ZIP GitHub gives you works as it is; no need to unzip it. Files are read in this tab and never uploaded.

Your code never leaves your browser

  • Your files are read inside this browser tab. They are never uploaded, to us or to anyone.
  • The report is built in the tab too. We do not see it unless you choose to send it to us.
  • The page downloads two things: the audit engine (Pyodide, from the jsDelivr CDN) and offramp's scripts (from this site).
  • Close the tab and everything is gone. Nothing is stored.

Getting the ZIP

  1. 1Connect your project to GitHub from your app builder, if you have not already. Lovable and Emergent both can.
  2. 2On GitHub, open the repository and choose Code → Download ZIP.
  3. 3Drop the ZIP on this page. You do not need to unzip it.

Have the code on your computer already? Choose its folder instead.

What it checks

The same checks as the command line.

This page runs offramp's own Python code, unchanged, at a pinned version. Every check reports what it found, that it came back clean, or why it could not look.

Prefer the command line? offramp on GitHub

offramp @ a2be952

  • Row-level security is on for every table

    supabase.rls.disabled

  • No policy lets anyone change any row

    supabase.rls.permissive_write

  • No table is readable by everyone by accident

    supabase.rls.public_read

  • No credentials committed to the repository

    credential.committed

  • No secrets shipped to the browser

    frontend.secret_in_bundle

  • No hard-wired links to the app builder's platform

    platform.hardcoded_url

  • The backend has a health check

    service.no_health_endpoint