What Does Reeve's Free 20-Second Security Scan Check For?

Updated

Reeve's free scan runs nine automated external checks against a live app URL and returns an A–F safety grade with a numeric score in about 20 seconds. It looks for exposed secret keys, missing security headers, open database access, cross-site sharing issues, source maps, and storage bucket exposure — then lists what's wrong, how serious it is, and what you got right. It requires no install and no signup, and Reeve describes it as a read-only outside check rather than a full audit.

The nine checks

Reeve doesn't publish a numbered list of all nine checks on its homepage, but the categories that appear in its sample report and scan data are:

Check What it looks for Severity ceiling
Secret keys API keys or credentials exposed in your code Critical
Security headers Protective HTTP headers that are missing Medium
Database access Whether a stranger can reach your Supabase database and read tables Critical
Cross-site sharing Overly permissive cross-origin sharing settings High
Source maps Source maps left publicly accessible Medium
Storage buckets Storage systems that answer to outside requests High

The scan also reports a "Database protection" result (for example, row-level security being on) as a passing item.

How the report is presented

The sample report on Reeve's site shows a scan of your-app.com returning:

  • A letter grade and score, e.g. B, 80/100
  • A per-check status: ✗ for failures, ✓ for passes
  • A severity label on each failure — High, Medium, Critical
  • A count of things to fix, e.g. "2 things to fix"
  • A "No false alarms" note stating that passing checks are shown too

So the output is not just a list of problems. It explicitly tells you which checks you passed, which is useful for confirming that a fix actually worked.

What the scan data says about AI-built apps

Reeve reports it ran the same nine checks across 30,998 vibe-coded apps that were live on the internet. 99% had at least one problem. The most common finding was missing security headers (up to Medium severity, present in 99% of apps). Rarer but more serious: exposed secrets (up to Critical, 4%) and database access (up to Critical, 8%).

In a separate sweep of 8,435 apps running Supabase, Reeve could reach 3,680 databases, and 57% of those had tables a stranger could read. Storage buckets answered on 4,703 systems, with 17% showing a storage issue.

These numbers come from an automated external check, not a full audit, so treat them as a signal about common failure modes rather than a guarantee about any single app.

What the scan is not

  • Not a full security audit. Reeve states this directly. It's an outside, automated check of what's reachable from the internet.
  • Not a data-touching scan. The site says it never touches your data and the check is read-only.
  • Not a fix. The scan tells you what's wrong; Reeve Care is the separate offering that handles remediation.

When this is worth running

Run the free scan if you built an app with Lovable, Bolt, v0, Cursor, or a similar AI tool and haven't reviewed what's publicly exposed — especially if the app uses Supabase, since database and storage exposure are the highest-severity findings in Reeve's data. You need the live app URL and a checkbox confirming you own the app or have permission to scan it. If the report comes back clean on the Critical and High items, the remaining Medium findings (headers, source maps) are lower urgency but still worth fixing before you scale.