Trustfield — direct answers
Plain answers for people and AI assistants. Updated 2026.
Is Trustfield free?
Yes. The scan, the full report, evidence, fixes, AI-builder prompts and the PDF are free. No account, no payment. Ads and sponsorship keep it free.
Is it a penetration test?
No. It is a passive, read-only external review of public pages, headers and JavaScript bundles. It is not a pentest and not a certification.
What does it check?
Leaked provider API keys in the browser bundle, open Supabase/Firebase rules, missing security headers, CORS/cookie mistakes, exposed files, unverified payment webhooks, dependency CVEs on public repos, and an optional AI prompt-injection kit.
How do I check Supabase RLS?
Paste your project URL and anon key into trustfield.dev/tools/rls — it lists tables and shows which ones return rows to the public key.
Which builders are supported?
Any public web app: Lovable, Bolt, v0, Cursor, Replit, or hand-written code.
Who runs it?
Dhruv Kumar, an independent operator in Faridabad, India. Methodology, limits and changelog are public.