Sample paid report

What the deep scan gives you.

The paid report turns public launch warnings into copyable prompts for Cursor, Lovable, Bolt, Replit, Claude Code, or any AI coding workflow.

Free preview first.

Run the public scorecard before paying. Unlock the deep scan only when the preview shows a useful finding or you want final launch QA.

PayPal-hosted approval.

Checkout happens on PayPal. LaunchGlint never asks for card numbers, passwords, source code, repository access, or production secrets.

Report opens on return.

After PayPal approval, LaunchGlint verifies the order, runs the deep scan, and opens the report with markdown, prompts, and checklist.

Example score

54 F

https://example-ai-app.com Sample report

Example findings

critical

Possible live Stripe secret key exposed

Matched a known high-risk token pattern in public HTML or bundled client code.

Immediately rotate the exposed Stripe key, remove it from client code, and move all secret-key Stripe calls to the server.

medium

Supabase project URL is visible

Client bundle references a Supabase project.

Verify every table has row-level security enabled, anon policies are least-privilege, and no service role key is shipped to the browser.

Copyable fix prompt

Paste this into your AI coder.

Fix exposed Stripe secret key

You are fixing a pre-launch risk in this app.
Finding severity: critical
Finding category: secrets
Evidence: Matched a known high-risk token pattern in public HTML or bundled client code.
Task: Immediately rotate the exposed Stripe key, remove it from client code, and move all secret-key Stripe calls to the server.
After changing code or configuration, explain exactly how to verify the fix.

Deployment playbook

Firebase Hosting deployment path.

LaunchGlint uses strong public hosting signals when available. Custom domains receive a provider-neutral path rather than a guess.

Add response-header rules to the hosting section of firebase.json.
Deploy Hosting again and verify the production response, not only localhost.
Rescan the exact web.app or custom domain and confirm each expected header is present.

Launch checklist

Before posting publicly.

Do not launch until every critical finding is fixed and rechecked.
Rotate any key or token that appeared in public HTML, JavaScript, logs, or screenshots.
Create two test users and confirm neither can read or change the other's data.
Confirm payment, refund, support, Terms, and Privacy links are visible before checkout.
Re-run LaunchGlint after fixes and keep the before/after score for launch marketing.