02 · SaaS product · 2026
LeftUnlocked
Left Unlocked scans apps built with AI tools like Lovable, Bolt and v0, and explains in plain language what was left open and how to close it. No sign-up, no jargon, read-only. I planned, designed, wrote and built the whole product, from the first page to payments.
16
read-only checks in every scan
301
scans in the last 30 days
5
guides, one per tool
100
in all four Lighthouse categories on desktop
01The challenge
AI tools like Lovable and Bolt let anyone put an app online in an afternoon. Security doesn’t come with them: tables open to the whole world, paid API keys sitting in the browser, and sites without basic security headers.
Existing tools talk to security people: long reports, jargon and severity scores. Whoever built the app needs to know at a glance whether something is open, and exactly what to paste to close it.
02The approach
- 01
The scan is on the homepage
One field and one button, above the fold. No feature tour and no sign-up before the first scan. You can get a result without going through any other screen first.
What I didn’t doA classic landing page: hero, features, pricing, and only then sign-up.
- 02
What the scanner does, right by the button
Next to the button it says plainly: read-only, nothing is written, no user data is read. A separate page explains what the bot does, its limits and how to block it.
What I didn’t doA legal checkbox nobody reads.
- 03
Plain explanations and ready-made fixes
Every finding follows the same order: the evidence, why it matters, how to fix it, and a paste-ready fix for the tool the app was built with: a prompt for Lovable, SQL for Supabase, config for Vercel, Netlify and Nginx.
What I didn’t doA list of findings with CVE codes and links to docs.
- 04
No framework
No framework: HTML built on the server, a few small hand-written JavaScript modules, and fonts with tuned fallbacks so the page doesn’t jump when they load.
What I didn’t doA full React app for one field and a button.
03The solution
04Behind the design
Your app is live.
Ten seconds, read-only, plain English.
https:// my-store.lovable.app
- A heartbeat line: one SVG with a single spike. A green segment runs along it every seven seconds, and every 1.2 seconds during a scan. It’s the only animation on the site, on purpose.
- A five-color severity scale, from critical to info, so you can read a report before reading a word.
- The grade is announced to screen readers, and focus moves to it when the scan finishes.
- Support for reduced motion, Windows high contrast mode and the "increase contrast" setting. No accessibility overlay widget, on purpose.
- The placeholder in the URL field types out real example addresses by itself, so it’s obvious what to paste.
05The result
The product is live and used by real people: 301 scans in the last 30 days, with payments, GitHub sign-in and automatic pull requests with the fixes.
The site’s own security headers meet the same standard it checks other sites against.
Lighthouse · measured 2 Oct 2026
| Metric | Mobile | Desktop |
|---|---|---|
| Performance | 95 | 100 |
| Accessibility | 100 | 100 |
| Best practices | 100 | 100 |
| SEO | 100 | 100 |
| LCP | 2.5s | 0.5s |
Security headers · 2 Oct 2026
A
- Present:Content-Security-Policyno unsafe-inline
- Present:Strict-Transport-Security
- Present:X-Frame-OptionsDENY
- Present:X-Content-Type-Options
- Present:Referrer-Policy
- Present:Permissions-Policy
Scan grades, last 30 days
From the site’s public stats, as of 2 Oct 2026
Want a site like this for your business?