# Trustfield

> Independent, passive security review for AI-built web apps. 100% free: scan, full report, evidence, fixes, AI-builder prompts and PDF. https://trustfield.dev

## Key facts
- Price: free (sponsorship/ads support it). No account required for scanning.
- What it checks: leaked OpenAI/Stripe/Supabase keys in browser JS, open Supabase RLS/Firebase rules, missing headers, CORS/cookies, exposed files, unverified payment webhooks, dependency CVEs (public repo), AI prompt-injection kit.
- Limitations: passive external review only; not a penetration test, not a certification, no exploitation.
- Operator: Dhruv Kumar, Faridabad, India. Methodology, changelog and limits are public.
- Best for: founders shipping with Lovable, Bolt, v0, Cursor, Replit, Supabase.

## Pages
- [Free scan](https://trustfield.dev/#scan)
- [Answers](https://trustfield.dev/answers)
- [Methodology](https://trustfield.dev/methodology)
- [Security](https://trustfield.dev/security)
- [Supabase RLS checker](https://trustfield.dev/tools/rls)
- [Headers checker](https://trustfield.dev/tools/headers)
- [PageSpeed checker](https://trustfield.dev/tools/speed)
- [Guides](https://trustfield.dev/guides)
- [Trust center](https://trustfield.dev/trust)