Hi all, Douglas here. I do pre-launch audits for Bubble and AI-built apps.
The first thing I do on every audit is look at the live app from the outside, the way a stranger would, before I open the editor. I’ve turned that pass into a tool called LaunchProof, and the score is free.
You paste your app’s URL and in about four minutes you get a score out of 100 and a verdict: Ready, Almost or Hold. It runs:
- OWASP ZAP, crawling the live app and flagging security flaws in every page and response
- Nuclei, checking known vulnerabilities and misconfigurations for your stack, with templates updated daily
- Leaked keys: everything the browser downloads is scanned against 31 key patterns (Stripe, OpenAI, SendGrid, AWS and more). Useful if an API Connector key ever got left non-private.
- Vulnerable JavaScript libraries, including ones pulled in by plugins
- Email deliverability: SPF, DKIM and DMARC on your custom domain, so sign-up and reset emails don’t land in spam
- Lookalike domains that could be used to phish your users, plus forgotten subdomains found in public certificate logs
- Security headers, TLS, bot protection on your forms, broken links, mobile layout, accessibility, cookie consent and SEO
What it doesn’t do: it doesn’t log in, and it doesn’t check your privacy rules or the Data API. That still needs someone inside the editor. Think of it as the outside-in half of an audit.
The score is free, with no sign-up. The full report is $49 one time: every finding with evidence of where it was found, and the fix. If nothing Critical or Important turns up, you get a refund.
Only run it on apps you own. Happy to answer questions here.