What Is Reeve and What Does It Do for AI-Built Apps?

Updated

Reeve is a free security scan and monitoring service for apps built with AI tools like Lovable, Bolt, v0, and Cursor. You paste your app or website link, and in about 20 seconds you get an A–F safety grade based on nine automated checks. No install and no signup are required, and the scan is a read-only outside check — Reeve states it never touches your data. It's aimed at people who shipped a vibe-coded app and want to know whether it's leaking secrets or exposing user data before someone else finds out.

What the scan actually checks

The scan runs the same nine checks on every app. Reeve's published report on 30,998 live vibe-coded apps shows what those checks tend to find:

Problem Most serious level seen Share of apps affected
Security headers up to Medium 99%
Cross-site sharing up to High 22%
Source maps up to Medium 13%
Database access up to Critical 8%
Exposed secrets up to Critical 4%

Across that sample, 99% of apps had at least one problem. The report also notes that Reeve tells you what you got right, not just what's broken — the sample report shows a score (for example, 80/100, grade B) with a short list of items to fix and a "no false alarms" note.

The scan is an automated external check, not a full audit. Treat the grade as a fast triage signal, not a certification.

Why the database layer matters most

Reeve's own framing is blunt: a broken front end costs you a customer, but an open Supabase database costs you all of them. That's the layer where user data actually lives, and it's the one part of a vibe-coded app that can leak everything at once.

In a sweep of 8,435 apps running Supabase, Reeve could reach 3,680 databases. Of those, 57% had tables a stranger could read. Storage buckets showed up as a High-severity issue in 17% of the storage systems that answered (4,703 of them). If your app stores anything in Supabase, this is the check to look at first.

Beyond the one-time scan

A scan tells you what's wrong today. Reeve Care is the ongoing layer: it watches your app and backs it up, described as "the undo button for your app." The workflow is three steps — point Reeve at your URL, get the report, then let it keep watching.

That matters because AI-built apps change fast. A config that was fine last week can break after your next prompt-and-deploy cycle, and a scan you ran once won't catch it.

When Reeve is a good fit

  • You built with Lovable, Bolt, v0, Cursor, or a similar tool and haven't audited the output.
  • You want a fast, no-install answer to "am I leaking anything?" before sharing the link widely.
  • You use Supabase and want to know whether row-level security is actually on.
  • You want continuous monitoring and backups rather than a one-off check.

When it isn't enough

  • You need a full security audit, penetration test, or compliance certification — Reeve's own report labels its checks automated and external, not a full audit.
  • Your app has no public URL to scan.
  • You need to fix the findings for you. The scan identifies problems; Reeve Care takes monitoring and backup off your plate, but you should confirm current plan details and pricing on the site before assuming what's included.

How to run your first scan

  1. Open reeve.page and paste your app or website address.
  2. Confirm you own the app or have permission to scan it.
  3. Run the free scan. Expected result: an A–F grade and a list of issues within roughly 20 seconds.
  4. Read the report top-down by severity — exposed secrets and database access first, then headers and source maps.
  5. Fix the critical items, then decide whether you want Reeve Care watching the app going forward.

The scan is free and needs no signup, but check the pricing page for what the monitoring and backup tier costs before you rely on it long-term.