Skip to content
Riyo Studio Perth, Western Australia Working across Australia and the Gulf, in English and Arabic Self-audit A+ 14 Nov 2026

Project code scan

Check your app's code for leaks before you launch.

Choose the main folder of your project, the one that holds package.json. Every page and file inside it is read, and you get a list of what to fix, where it is and how.

Reads
  • Your code
  • Folder structure
  • Config and .env files
  • Built apps (.apk, .aab, .ipa)

It runs in your browser. Your code is not uploaded.

Drop your project folder, .zip or built app (.apk, .aab, .ipa) here

or

Skips node_modules and .git. Works with code from Lovable, Bolt, Cursor, Replit and v0, or written by hand.

Choose your project folder

Your browser may ask for permission to view the folder. If it does, choose Allow. The scanner only reads files on your device, and nothing is sent anywhere.

What it looks for

Keys in your code

A Stripe, OpenAI, AWS or Supabase key typed into a file that anyone can read.

Files that should stay private

.env files and private key files that git is not set to ignore.

An open database

Supabase tables without row-level security, and Firebase rules that let anyone read or write.

Risky code

Queries built from user input, pages that skip the sign-in check, and AI keys called from the browser.

Inside a built app

Keys left inside an .apk, .aab or .ipa, an app signed with the debug key or open to debugging, and traffic allowed without encryption.

Will it break?

Imports that point nowhere, packages that are not installed, settings nobody defined, calls to routes that do not exist, and code left unfinished.

Once it's live

Is your project live? The in-depth audit checks more.

The project scan reads your code. Once the app is online, the audit tests the running site from the outside, which finds what code alone can't show.

See the in-depth audit
  • Keys and .env files that ended up public
  • Open database and file storage (Firebase, Supabase)
  • Downloadable backups and forgotten test or admin sites
  • Known holes in WordPress and code libraries
  • Email spoofing protection and domain set-up
  • …and more, which only the in-depth audit does
Free website checkAlready live? Check a website's security, speed and email setup in a minute. Want it fixed for you?Riyo Studio can fix these and keep watch afterwards.