Find the leaks in your AI-built app before anyone else does.
Cobalt Owl checks what your Lovable, Bolt or Cursor app shows the public internet: exposed keys, open Supabase tables, missing headers. You get a plain-English report and a prompt to fix each issue.
Read-only checks. Keys are masked. We count rows, never read them.
What one scan checks
The mistakes AI builders make most often, checked from the outside, the way a stranger would see your app.
How it works
Paste your app's URL
The address of your deployed app, like yourapp.lovable.app or your own domain.
Confirm it's yours
Tick the box to confirm you own the site or are allowed to test it. We scan nothing without it.
Fix with one prompt
Each issue comes with a short explanation and a prompt you paste into Lovable, Cursor or Claude Code.
A finding, and the fix you paste
This is example data, showing the format you get for every issue.
Your app ships a public Supabase key, which is normal. But Row Level Security is off on this table, so anyone with that key can read every profile. We counted the rows and read none of them.
Pricing
Start with a free scan. Pay only if you want the full report or ongoing checks.
Full report
- Everything in Free
- Downloadable PDF report
- Re-scan after you fix
Monitor
- Weekly scans of one app
- Email alert when something new appears
- Scan history
Paid plans are not live yet. Joining the waitlist costs nothing.
How we handle your data
A security tool should be careful with what it sees. These are the rules our scanner follows.
We request the same pages and files any visitor's browser can request. No logins, no forms, no attacks.
Found keys are shown as the first few and last few characters. We never store a full key.
For open database tables we ask for a row count. We never download rows.
We keep the host, score and number of issues for 90 days, then delete them.
Email privacy@cobaltowl.dev and we remove your scans and waitlist entry.
Security contact and policy are in security.txt.
Questions
Is a scan safe to run on my live app?
Yes. Every check is a normal read request, like a visitor loading your site. We don't submit forms, log in, or send attack payloads.
Can I scan a site that isn't mine?
No. You must own the site or have permission to test it, and you confirm that before every scan. Scans are rate-limited.
Does a good score mean my app is secure?
No. It means the issues we check for weren't found from the outside. It isn't a penetration test or a code review.
Which builders does it work with?
Any deployed website. The fix prompts are written for Lovable, Bolt, Cursor and Claude Code, and the Supabase checks matter most for apps built on Supabase.
Who runs Cobalt Owl?
Cobalt Owl is operated by Organic Media Buying LLC, a US company.
Check your app today. Get told when it changes.
Run a free scan now, or join the waitlist for weekly monitoring.