Deckproof
DE
00 / Free, no signup · Lovable, Bolt, v0, Cursor, Replit

Anyone can check your site. Be the first.

Open databases, keys in the source, no Impressum, trackers before consent, accessibility. 104 checks, a grade from A to F in 30 seconds, with proof and the text to paste back into your builder.

PASTE YOUR SITE'S ADDRESS
https://
No signupWe only lookSample report
CHECKED: 76 PUBLIC AI-BUILT SITES
29 %of the sites with a database were readable by strangers
5.102rows sat in those open tables
97 %no Impressum, 87 % no privacy notice
How we measured that
example report / app-redacted.lovable.apphost anonymised
D
58 / 100

A stranger could read your list of users.

4 problems1 critical1 high2 lower
DSecurity55 / 100A-01, T-02
CEU legal information78 / 100DE-IMP-01
BQuality88 / 100Q-09, Q-15
FIRST FIX / A-01 CRITICALLock the profiles table in Supabase. We give you the text to paste into Lovable, then re-check.
EXAMPLE

One open critical never scores above D.

If a stranger can read your users’ data, nothing else matters yet. A beautiful page does not lift the grade until that door is closed. That is the one rule behind the score.

45
POINTS OFF FOR ONE CRITICAL FINDING1

1 From the published formula below: start at 100 per area, subtract 45 per critical, 22 per high, 9 per medium, 3 per low.

01 / IDLE

Watch it earn its grade.

Every site starts at A+. Each real problem costs points, and one critical problem caps the grade at D. Mark the fixes and watch it climb back. Scroll to run the scan, scroll up to rewind.

A+
100 / 1000 findings

SCROLL TO SCAN

assembling
02 / What it looks at

The checks list, in the open.

104 checks in three areas, written so you do not need a developer to understand them. Below is the part of the list that decides most grades. Every ID here is the same ID you see in your report. See every check.

SECURITY9 of 27 shown
A-01
Anyone can read your database
Your Supabase table answers to anyone who asks, no login needed. That is your users' data, readable by strangers. We ask once for a count only, never for a row, and report what came back.
CRITICAL
A-05
Your file storage is listable
Supabase Storage answers an anonymous request for its bucket list, and lets a stranger list the files inside. Public buckets serve every file to anyone with the link.
HIGH
S-01
Your master key is inside the page
The Supabase service key sits in your site's code. Whoever reads it owns your whole database, every lock ignored.
CRITICAL
S-02
A secret key is in your page
We look through your site's code for keys (Stripe, OpenAI, AWS, GitHub) that should never be public. With them, someone can spend your money or read your data.
CRITICAL
S-04
Your settings file is downloadable
The .env file, with passwords and keys, is served like any other page.
CRITICAL
S-05
Your code history is public
The .git folder is reachable, so your entire source code, past versions included, can be downloaded.
HIGH
T-02
No Content-Security-Policy
A setting that stops injected scripts. Without it a bad script can run as if it were your page.
MEDIUM
C-02
Other sites can read your logged-in data
A sharing setting (CORS) echoes any origin and allows credentials, so any website can ask your backend for a visitor's data while they are logged in. A plain "*" for public data is fine and is not reported.
HIGH
DE-SEC-01
No padlock
Not served over HTTPS, or the certificate is expired or untrusted. Fix this first, everything else waits.
CRITICAL
EU LEGAL INFORMATION4 of 19 shown
DE-IMP-01
No Impressum found
German law expects a provider page on commercial sites (§5 DDG). We say what we found and link the rule. General information, not legal advice.
HIGH
DE-PRIV-01
No privacy notice found
EU law expects one (Art. 13 GDPR). We look for a linked page under the usual names. General information, not legal advice.
HIGH
DE-CK-03
Tracking before consent
In a real browser, on a fresh visit, we watch which analytics or ad services send data and which cookies are written before anyone clicks, and again after clicking "reject" on the banner. A tag that merely loads with Consent Mode set to denied is told apart from a pixel that fires. Without the browser pass: trackers in the code with no consent tool. General information (§25 TDDDG).
HIGH
DE-3P-01
Fonts loaded from Google
Every visitor's address is sent to Google on each visit; often flagged since a 2022 Munich court ruling. Confirmed in a real browser when the deep scan runs. General information.
MEDIUM
QUALITY2 of 11 shown
Q-09
Google sees an empty page
Your site only appears after code runs in the browser, so search engines and link previews see nothing.
MEDIUM
Q-05a
Missing page title or description
Search results and browser tabs show the bare address instead of your name.
MEDIUM
03 / Poke the findings

Three of the things it catches, live.

Each one is a real check from the list. Nothing here touches a real site; it is a piece of the report, taken apart so you can push on it.

Readable without login

A-01 / DATABASE

Your builder gives your site a database. If a table is not locked, anyone who knows the address can read it, without logging in. This is what that looks like. Hover a key: the crawler shows it, then masks it again.

emailstripe_tokenplan
lena.k@…sk_live_••••••••••••sk_live_9fQ2…Vt7apro
omar.b@…sk_live_••••••••••••sk_live_2aN8…Kd01free
jonas.w@…sk_live_••••••••••••sk_live_7Hc3…Pq9mpro
LOCKED BY ROW LEVEL SECURITY
3 ROWS EXPOSED

Missing security headers

T-01 … T-06 / RESPONSE

Headers are small settings your site sends to every browser. Each one closes a door. Click one to see what it protects you from. Red is missing on this sample site, green is set.

Trackers before consent

DE-CK-03 / TDDDG §25

Your cookie banner asks first, but do the trackers wait for the answer? We open the page fresh, touch nothing, and record what runs before you choose.

Google Analyticsfired at 0,4 s
Meta Pixelfired at 0,6 s
Session cookieconsent-gated

Two trackers already ran before you could decide.

04 / Method

The grade is simple maths, and it is published.

You should be able to check the maths yourself, and you should know exactly what we do not do to your site.

Each area (security, EU legal, quality) starts at100
Per critical finding−45
Per high finding−22
Per medium finding−9
Per low finding−3
Per informational finding0
Composite scoremean of the three areas
With at least one open critical, the composite is capped at58
A+95+
A90
B80
C70
D55
E35
F<35

What we don’t test

  • Nothing behind a login. We only see what any stranger sees.
  • We never submit forms, never write data, never upload anything. We only read.
  • No password guessing, no flooding your site with requests.
  • No legal judgement. For EU items we say what we found and link the rule, so you can decide for your case.

Your URL, your call

We use your URL only to run this scan. Fetched pages are discarded after grading; only the findings and the grade are kept for your report. Every request we make is shown in the replay next to your grade.

Keine Rechtsberatung: legal items are general information with sources, never individualised legal advice. Found a hole in Deckproof itself? Tell us.

05 / Pricing

The grade is free. Depth is paid.

Prices in EUR, VAT included. Payment is handled by Paddle as merchant of record, so your receipt comes from them. Cancel monthly plans any time.

EUR, VAT INCLUDED
Free
0
Report
5WAS 9 · TO 7 OCT
Pro
24/ MONTH
Agency
79/ MONTH
Composite grade and three area grades
yes
yes
yes
yes
The three most important problems by name, the most severe one with its full fix
yes
yes
yes
yes
Every problem found, by name and with what it means
no
yes
yes
yes
Every fix, written for your builder
no
yes
yes
yes
Text you paste into Lovable, Bolt or Cursor to fix it
no
yes
yes
yes
Proof for every finding: the columns and the row count a stranger reaches
no
yes
yes
yes
Full request replay and PDF report
no
yes
yes
yes
Re-check after fixing, in 60 seconds
no
yes
yes
yes
Unlimited scans
no
no
yes
yes
Daily re-check with an email if the grade drops or a certificate or domain is about to expire
no
no
yes
yes
A grade badge to show on your site
no
no
yes
yes
White-label PDF and private client report links
no
no
no
yes
Multi-site dashboard, bulk grading, before and after, CSV export
no
no
no
yes

Launch price until 7 October 2026, 23:59 CEST. Regular price EUR 9, which is also the lowest price of the last 30 days.