reeve.page

Reeve's published scan data shows that almost every AI-built app it checked had at least one issue. Across 30,998 live vibe-coded apps, 99% had at least one problem. The most common finding was missing security headers (99% of apps, up to Medium severity), followed by cross-site sharing (22%, up to High), exposed source maps (13%, up to Medium), database access (8%, up to Critical), and exposed secrets (4%, up to Critical). These numbers come from an automated external check, not a full audit, so treat them as a signal of how widespread each issue is rather than a verdict on any single app.

The five findings, in order of how often they show up

The pattern worth noticing: the two most frequent problems are also the least severe, and the two rarest are the ones that can expose everything. Frequency and risk don't move together here.

Security headers (99%, up to Medium)

Nearly every app was missing some protective response headers. This is a low-effort fix and rarely the thing that sinks an app on its own, but it's the baseline almost nobody hits.

Cross-site sharing (22%, up to High)

Roughly one in five apps had sharing configurations that let other origins reach data they shouldn't. This sits in the middle of the severity range and is easy to overlook because the app still works fine.

Source maps (13%, up to Medium)

About one in eight apps shipped source maps that expose original code. Not a data leak by itself, but it hands an attacker a map of your app.

Database access (8%, up to Critical)

This is where the stakes jump. Among the 3,680 apps where Reeve could actually reach a Supabase database, 57% had tables a stranger could read. That's the finding behind Reeve's framing that a broken front end costs you a customer while an open database costs you all of them — user data lives in this layer, and one misconfiguration can expose all of it at once.

Exposed secrets (4%, up to Critical)

The rarest finding, and one of the two Critical ones. A secret key sitting in client-side code or headers means anyone who looks can use it.

Why the database number is the one to check first

The headline 8% understates the risk because it's measured against all apps. Narrow the view to apps that actually have a reachable Supabase database and the picture changes:

• 3,680 databases answered Reeve's check
• 57% of those had tables a stranger could read
• Storage buckets showed up as a problem in 17% of the Supabase apps in that sweep

If your app uses Supabase, the relevant question isn't "did I land in the 8%" — it's whether row-level security is actually on and whether your tables and storage buckets reject anonymous reads. That's a configuration question you can answer directly, not a probability.

What these numbers do and don't tell you

They're useful for one thing: knowing which problems are common enough that you should assume you have them until you check. Missing headers at 99% means you almost certainly have that one. Exposed secrets at 4% means it's unlikely but catastrophic, so it's still worth a look.

They don't tell you your app's grade. The scan is an automated external check — it sees what's reachable from outside, not your full configuration or code. Reeve's own wording is explicit that this isn't a full audit. Use the distribution to prioritize, then verify your own app's specific state rather than assuming you match the average.

Reeve Care is the ongoing layer that starts after the free scan: instead of leaving you with a list of problems, it takes over the watching and the backing up of your app. According to Reeve, the scan is a read-only outside check that grades your app A–F in about 20 seconds, and Reeve Care is what "takes it off your plate" once you know what's wrong. The backup side is described as "the undo button for your app" — a way to restore things when something breaks.

The three-step flow

Reeve frames the whole product as three steps, from "I hope it's fine" to "I know it's covered":

1. Paste your app or website link. No install, no signup, and Reeve states it never touches your data. You confirm you own the app or have permission to scan it.
2. Get a grade. The scan runs the same nine checks Reeve uses across its sample data and returns an A–F safety grade with a score, plus what you got right — Reeve notes it avoids false alarms and tells you what's already correct.
3. Move to ongoing coverage. This is where Reeve Care comes in: watching the app and backing it up rather than just reporting once.

What the scan itself checks

The scan is an automated external check, not a full audit. Across 30,998 live vibe-coded apps, Reeve reports these findings and how often they appeared:

Reeve's headline stat: 99% of the apps it scanned had at least one problem.

Why the database layer matters most

Reeve's argument for continuous coverage is that a broken front end costs you one customer, while an open database costs you all of them. In a sweep of 8,435 apps running Supabase, Reeve could reach 3,680 databases — and 57% of those had tables a stranger could read. Two checks in that sweep ran on smaller samples: 3,680 databases and 4,703 storage systems actually responded.

That 57% figure is the clearest case for why a one-time scan isn't enough: the data layer is the part that can leak everything at once, and it's the part most likely to change as you keep building.

What Reeve Care adds beyond the report

• Watching: the scan tells you what's wrong once; Reeve Care keeps an eye on it so a new exposure doesn't sit unnoticed.
• Backing up: described as the undo button — a restore point for when a change breaks the app.
• Doing the fixing: Reeve positions Care as taking the remediation work off your plate rather than handing you a to-do list.

Practical notes before you start

• The scan is free, requires no signup, and is a read-only outside check.
• You must own the app or have permission to scan it.
• Scanning implies agreement to Reeve's Terms of Service and Privacy Policy.
• Reeve states it never touches your data during the scan.
• Reeve's own framing is explicit that this is an automated external check, not a full audit — treat the grade as a starting signal, not a certification.

For current plan details and what Reeve Care includes at each tier, check the pricing page directly, since the source material here covers the scan and the Care concept rather than specific plan limits.

Paste your app or website URL into the scan box on reeve.page, tick the ownership/permission checkbox, and click "Scan my app, free." About 20 seconds later you get an A–F safety grade plus a list of what's wrong and what you got right. No install, no signup, and the check is read-only from the outside — Reeve states it never touches your data.

Before you scan

• A live URL. The scan is an external check, so your app or site needs to be reachable on the internet. Local-only builds won't work.
• Permission. You must own the app or have permission to scan it. The checkbox on the page is how you confirm this.
• Agreement to the terms. By scanning you agree to Reeve's Terms of Service and Privacy Policy.
• No account needed. The free scan is listed as free with no signup, so you can run it before deciding whether you want anything more.

Step-by-step

1. Go to reeve.page.
2. Enter your app or website address in the field (the sample shows a format like your-app.com).
3. Check the box confirming you own the app or have permission to scan it.
4. Click Scan my app, free.
5. Wait roughly 20 seconds. The report screen shows a progress state ("Scanning your-app.com") before results appear.

What the report gives you

The result is a letter grade (A–F) with a numeric score — the sample shows a B / 80 out of 100 — plus a per-check breakdown. Each item is marked with a status and a severity level, and the report explicitly calls out things you got right, not just failures. The sample report shows:

Reeve describes this as the same nine checks it runs across apps, and labels it an automated external check rather than a full audit — worth keeping in mind when you read the grade.

What the nine checks cover

Based on Reeve's published scan data, the checks include security headers, cross-site sharing, source maps, database access, exposed secrets, and storage buckets. The most common finding by far is missing security headers (seen in 99% of scanned apps, up to Medium severity). Rarer but more serious: exposed secrets (4%, up to Critical) and database access (8%, up to Critical).

If your app uses Supabase, the database and storage checks are the ones to read closely. Reeve reports that of 3,680 reachable Supabase databases, 57% had tables a stranger could read — the failure mode where one open database exposes everything at once.

Common snags

• Scan won't run: the URL isn't publicly reachable, or the permission checkbox isn't ticked.
• Grade looks fine but you're unsure: the scan is an outside-in automated check, not a full audit. Treat a good grade as "no obvious external leaks found," not "certified secure."
• You want ongoing coverage rather than a one-time result: that's a separate product question — see the next section.

If you want more than a one-time scan

The free scan tells you what's wrong once. Reeve also describes a monitoring and backup offering ("Reeve Care") that watches the app and backs it up, plus an "undo button" framing for restoring your app. Pricing and plan details aren't specified in the material here, so check the Pricing page at reeve.page/pricing for current terms before assuming what's included or free beyond the scan.

Reeve is a free security scan and monitoring service for apps built with AI tools like Lovable, Bolt, v0, and Cursor. You paste your app or website link, and in about 20 seconds you get an A–F safety grade based on nine automated checks. No install and no signup are required, and the scan is a read-only outside check — Reeve states it never touches your data. It's aimed at people who shipped a vibe-coded app and want to know whether it's leaking secrets or exposing user data before someone else finds out.

What the scan actually checks

The scan runs the same nine checks on every app. Reeve's published report on 30,998 live vibe-coded apps shows what those checks tend to find:

Across that sample, 99% of apps had at least one problem. The report also notes that Reeve tells you what you got right, not just what's broken — the sample report shows a score (for example, 80/100, grade B) with a short list of items to fix and a "no false alarms" note.

The scan is an automated external check, not a full audit. Treat the grade as a fast triage signal, not a certification.

Why the database layer matters most

Reeve's own framing is blunt: a broken front end costs you a customer, but an open Supabase database costs you all of them. That's the layer where user data actually lives, and it's the one part of a vibe-coded app that can leak everything at once.

In a sweep of 8,435 apps running Supabase, Reeve could reach 3,680 databases. Of those, 57% had tables a stranger could read. Storage buckets showed up as a High-severity issue in 17% of the storage systems that answered (4,703 of them). If your app stores anything in Supabase, this is the check to look at first.

Beyond the one-time scan

A scan tells you what's wrong today. Reeve Care is the ongoing layer: it watches your app and backs it up, described as "the undo button for your app." The workflow is three steps — point Reeve at your URL, get the report, then let it keep watching.

That matters because AI-built apps change fast. A config that was fine last week can break after your next prompt-and-deploy cycle, and a scan you ran once won't catch it.

When Reeve is a good fit

• You built with Lovable, Bolt, v0, Cursor, or a similar tool and haven't audited the output.
• You want a fast, no-install answer to "am I leaking anything?" before sharing the link widely.
• You use Supabase and want to know whether row-level security is actually on.
• You want continuous monitoring and backups rather than a one-off check.

When it isn't enough

• You need a full security audit, penetration test, or compliance certification — Reeve's own report labels its checks automated and external, not a full audit.
• Your app has no public URL to scan.
• You need to fix the findings for you. The scan identifies problems; Reeve Care takes monitoring and backup off your plate, but you should confirm current plan details and pricing on the site before assuming what's included.

How to run your first scan

1. Open reeve.page and paste your app or website address.
2. Confirm you own the app or have permission to scan it.
3. Run the free scan. Expected result: an A–F grade and a list of issues within roughly 20 seconds.
4. Read the report top-down by severity — exposed secrets and database access first, then headers and source maps.
5. Fix the critical items, then decide whether you want Reeve Care watching the app going forward.

The scan is free and needs no signup, but check the pricing page for what the monitoring and backup tier costs before you rely on it long-term.

Reeve's free scan runs nine automated external checks against a live app URL and returns an A–F safety grade with a numeric score in about 20 seconds. It looks for exposed secret keys, missing security headers, open database access, cross-site sharing issues, source maps, and storage bucket exposure — then lists what's wrong, how serious it is, and what you got right. It requires no install and no signup, and Reeve describes it as a read-only outside check rather than a full audit.

The nine checks

Reeve doesn't publish a numbered list of all nine checks on its homepage, but the categories that appear in its sample report and scan data are:

The scan also reports a "Database protection" result (for example, row-level security being on) as a passing item.

How the report is presented

The sample report on Reeve's site shows a scan of your-app.com returning:

• A letter grade and score, e.g. B, 80/100
• A per-check status: ✗ for failures, ✓ for passes
• A severity label on each failure — High, Medium, Critical
• A count of things to fix, e.g. "2 things to fix"
• A "No false alarms" note stating that passing checks are shown too

So the output is not just a list of problems. It explicitly tells you which checks you passed, which is useful for confirming that a fix actually worked.

What the scan data says about AI-built apps

Reeve reports it ran the same nine checks across 30,998 vibe-coded apps that were live on the internet. 99% had at least one problem. The most common finding was missing security headers (up to Medium severity, present in 99% of apps). Rarer but more serious: exposed secrets (up to Critical, 4%) and database access (up to Critical, 8%).

In a separate sweep of 8,435 apps running Supabase, Reeve could reach 3,680 databases, and 57% of those had tables a stranger could read. Storage buckets answered on 4,703 systems, with 17% showing a storage issue.

These numbers come from an automated external check, not a full audit, so treat them as a signal about common failure modes rather than a guarantee about any single app.

What the scan is not

• Not a full security audit. Reeve states this directly. It's an outside, automated check of what's reachable from the internet.
• Not a data-touching scan. The site says it never touches your data and the check is read-only.
• Not a fix. The scan tells you what's wrong; Reeve Care is the separate offering that handles remediation.

When this is worth running

Run the free scan if you built an app with Lovable, Bolt, v0, Cursor, or a similar AI tool and haven't reviewed what's publicly exposed — especially if the app uses Supabase, since database and storage exposure are the highest-severity findings in Reeve's data. You need the live app URL and a checkbox confirming you own the app or have permission to scan it. If the report comes back clean on the Critical and High items, the remaining Medium findings (headers, source maps) are lower urgency but still worth fixing before you scale.