Check your AI-built app

How the check works

Apps built with Lovable, Bolt, Cursor and similar tools often look finished before they are. The screens work in a demo. The problems are in the parts you cannot see: headers, keys, error states and what happens when a real user does something unexpected.

The health check looks at your app two ways. Automated checks on your live URL cover what can be measured from the outside. A short self-assessment covers what cannot. Each half is worth 50 points, for a score out of 100.

The automated checks

When you submit a URL, the check runs it through Google PageSpeed Insights on mobile and reads four scores:

• Performance: how fast the page loads and becomes usable on a phone.
• Accessibility: whether people using screen readers, keyboards or zoom can use it.
• SEO: the basics that let search engines read and list the page.
• Best practices: common technical problems, such as errors in the browser console.

Then it checks the page itself:

The key scan matters most. AI tools sometimes put an API key in front-end code because it is the quickest way to make a feature work. Anything in the page's HTML can be read by anyone who opens it.

The automated half splits two ways. The average of the four PageSpeed scores is worth 30 points. The page checks are worth 20, weighted by how much each one matters: a leaked key or no HTTPS counts five times as much as a missing language tag. If PageSpeed is busy and does not answer, the page checks stand in for the whole automated half, and the result says so.

The self-assessment

A URL cannot show whether your password reset works or whether your database is backed up. So the other half of the score is a checklist you answer yourself:

A box you leave unticked counts as no. If you do not know, it is probably not done.

Answer it honestly. Nobody else sees it, and the score is only useful if it is true.

What the score means

The score is a rough guide to how ready your app is for real users, not a grade. A high automated score with a low checklist score is common: the page is fast and tidy, but the app behind it is fragile. That is usually the more serious problem.

Under the score you get the top five issues in plain English, with what each one means for your users. A leaked key or broken access rules matter far more than a missing meta description, so fix those first.

Every failed check, every weak PageSpeed score and every box you left unticked gets a weight for how much harm it does. The five heaviest make the list. A PageSpeed score counts for more the further it falls below 90.

Limits

• It checks one page, the URL you submit. It does not crawl the rest of your site.
• It cannot log in, so it cannot see anything behind auth.
• PageSpeed scores move a little between runs. Treat small changes as noise.
• The key scan looks for known patterns in the page's HTML only, not in separate script files, so a clean result is not proof that no key has leaked. Publishable keys, like Stripe's, are meant to be public and are not flagged. A match is a prompt to check, not proof of a leak.
• The checklist is self-reported.

Privacy and limits on use

Only the URL you submit is fetched, plus any redirects, and Google PageSpeed fetches it too. Complete results are cached for up to 24 hours, so running it again the same day usually shows the same result. Requests are rate limited, so the check cannot be used to hammer anyone's site. Email is optional. If you email the report to yourself, I get a copy too.

What a fix usually takes

If the check turns up problems, I fix them as a Rescue Sprint. The price is fixed, agreed in writing after the check and a call, and a sprint usually takes about a week. It covers auth, data, payments and errors, plus a mobile layout and accessibility pass, with handover notes on what changed.

For the longer version, read how to fix a vibe-coded app. If you would rather talk it through with your result in front of you, book a call.

What your result meansVibe-coded app broken? How to fix it

Questions founders ask

Does it work on apps built with Lovable, Bolt or Cursor?

Yes. It checks a live URL, so it works on any public site, whatever built it. The checklist covers the problems that AI-built apps most often have.

What does the check actually do to my site?

It fetches the one URL you submit, runs it through Google PageSpeed Insights and reads the page's HTML and headers. It does not crawl other pages, log in or submit forms. Results are cached for up to 24 hours and requests are rate limited.

How is the score worked out?

Half of the 100 points come from the automated checks on your URL. The other half come from the self-assessment checklist, which covers what a URL cannot show, like auth, payments and backups.

It says it found an exposed key. What now?

Check whether it is a secret key or one meant to be public. Some keys, like publishable payment keys, are designed to sit in the browser. If it is a secret key, rotate it with the provider straight away and move it server-side.

Why did my score change when I ran it again?

PageSpeed results vary a little between runs, and a change to your site may not show up until the cache, which lasts up to 24 hours, expires. Your checklist answers also count for half the score.

What does a fix cost?

Fixes are done as a Rescue Sprint, at a fixed price agreed after the check and a call. It usually takes about a week.

More free tools

Free tool, no sign-upMVP cost calculatorPick your product type, platforms and features to see a price range in pounds for three routes, a rough timeline and what to build first.Estimate your MVP costFree tool, no sign-upMVP feature scoping toolWrite your idea, list the features, answer three questions about each, and get a must-have, should-have and later list you can print.Scope your MVP