Continuous health + security watch

Your app is live. Is it still good?

All Still Good holds a known-good baseline of your live app, re-checks it on schedule and after every deploy, and raises exactly one kind of noise: something is new or worse — here’s the fix. This is the console it runs from.

Built for founders who shipped with Lovable, Bolt, Cursor, Replit or v0 — and have real users, but can’t read their own code.

acme-crm.vercel.appstanding watch · hourly · read-only
1 Medium2 Low
last scan08:00 · 48 checks
Watch log · this morninglive
07:12:04deploy detected · vercel webhook
07:12:31scan #48 · 48 checks against baseline1 new
07:12:31RLS-01 · customers table readable without logincritical
07:12:33alert sent · fix brief written for Cursor
07:31:02scan #49 · re-check after your fixresolved
08:00:00scheduled scan · all quiet0 new
Health · last 7 scansdip = deploy #14 · caught + resolved same morning

8 probe families · deploy-aware · silent when green

The difference between a scan and a watch

A scanner gives you a report. The watch remembers.

Every scan is classified against your baseline — new, regressed, unchanged, resolved — and correlated to the deploy that caused it. That memory is what a one-off scanner can never give you.

Baseline heldday 0

One read-only scan becomes your known-good snapshot.

Deploy #12day 6

Webhook fires, re-scan runs — no change against baseline. Silence.

Deploy #14day 9

Regression caught — RLS switched off on customers. Alert inside a minute.

Resolvedday 9

Your pasted fix verified by re-scan. The log returns to quiet.

Every finding is one ofnewregressedunchangedresolved
The probe array · all read-only

Eight families of checks, against an app you’ve proven you own.

RLS-01
Open databases

Supabase and Firebase data readable without logging in — the #1 leak in vibe-coded apps.

SEC-02
Secrets in the bundle

Live keys and service-role tokens in the JS you ship to every visitor.

API-03
Unauthenticated APIs

Endpoints that return data when nobody is signed in.

HDR-04
Security headers

CSP, HSTS, frame and transport hardening — set, or missing.

CKE-05
Cookies & CORS

Insecure session flags and reflected cross-origin rules.

ENV-06
Exposed files

.env and .git left reachable on your live domain.

CVE-07
Dependency CVEs

Known-vulnerable or typosquatted packages in your repo.

JRN-08
Uptime & journeys

Downtime, plus signup, login and checkout walked in a real browser.

No writes, no exploits, no DoS · secrets stored as redacted fingerprints only

When smoke appears

One email. Plain English. A fix you paste.

The console is for looking; the alert is for acting. When a scan finds something new or worse, you get the finding in words you can read and a brief written for the AI tool that built your app.

Critical · new since deploy #1407:13

Your customers table is readable without logging in.

Since your deploy at 07:12, anyone can read every row — names, emails and phone numbers — without signing in. Row Level Security is off on that table.

Fix brief · paste into Cursor
alter table public.customers enable row level security;
create policy "own rows" on public.customers
  for select using (auth.uid() = user_id);
Synthetic journeys · Pro and up

“The site loads” is not “people can pay you.”

A real browser walks your signup, login and checkout on every scan. When a step breaks, the alert names the step — not just “something is down.”

journey · sign-up passing
open /sign-upfill email + passwordsubmit formconfirm inboxpass · 8.4s
Rules of engagement

Built to be safe to point at your app.

Read-only

Probes observe, never touch. No writes, no exploits, no DoS.

Ownership-gated

Nothing scans until you prove the app is yours. A hard gate.

Redacted-only

Secrets kept as fingerprints. Personal data counted, never stored.

No service_role

The dangerous key is rejected at the door, by the validator.

Embeddable trust badge
monitored by All Still Good

A live status badge for your site. It reflects real checks and stops vouching the instant one fails — no static “secure” sticker.

Public status page · opt-in
All systems operational· health 96

A sanitized page you can show investors and customers — health and trend, never the findings themselves.

Pricing · cancel anytime

The baseline is free. The watch is the subscription.

Freeone-time
$0

A one-time baseline scan to see where you stand.

  • One-time baseline scan
  • Plain-English findings
  • Health score
Run the baseline
Prodaily
$19/mo

Continuous daily monitoring with alerts.

  • Daily continuous monitoring
  • Deploy-triggered re-scans
  • Email alerts on new/regressed issues
  • Up to 5 synthetic journeys
Start the watch
Businesshourly
$49/mo

Hourly monitoring for apps with real traffic.

  • Hourly continuous monitoring
  • Up to 25 synthetic journeys
  • Everything in Pro
Start the watch

Free is a one-time baseline — see what’s exposed today. Continuous monitoring, deploy-triggered re-scans, email alerts and synthetic journeys are the reason to go Pro, because the hole you fix this week can come back on next week’s deploy.

Questions, answered straight

The things people ask before they point it at their app.

Is it safe to point All Still Good at my app?

Yes. Every check is read-only and non-destructive — no writes, no exploits, no denial-of-service. Nothing runs until you've proven you own the app, and we never accept your Supabase service_role key.

Do you store my secrets or my users' data?

No. A leaked secret is kept only as a redacted fingerprint, never the raw value. Exposed personal data is counted, never copied into All Still Good.

What do I need to connect?

Just your app's URL and a quick ownership check — a DNS record, a meta tag, a hosted file, or a connected GitHub repo. You can optionally add a Supabase anon key or a GitHub repository for deeper checks.

Will I understand the results if I'm not technical?

Yes — that's the point. Every finding is written in plain English with a paste-ready fix brief tailored to the AI tool you already use, like Cursor, Lovable, Bolt or Claude Code.

Does All Still Good fix things for me?

No, and that's deliberate. It detects, explains, and hands you a fix to paste — it never changes your app. You stay in control of what ships.

How is this different from running a free scanner once?

A one-off scan protects you for exactly one deploy. All Still Good holds a known-good baseline and re-checks on a schedule and after every deploy, so it catches the hole the day a change reopens it.

What does it actually check?

Open Supabase and Firebase data, secrets in your shipped bundle, unprotected APIs, security headers, cookies and CORS, exposed .env/.git files, dependency CVEs, and whether signup, login and checkout still work in a real browser.

Can I scan an app I don't own?

No, by design. Ownership verification is a hard gate — All Still Good will not scan anything you haven't proven is yours.

What's free, and what do I pay for?

Free is a one-time baseline scan so you can see where you stand. Pro ($19/mo) adds daily continuous monitoring, deploy-triggered re-scans, email alerts and synthetic journeys. Business ($49/mo) watches hourly. Cancel anytime and keep access through the period you paid for.

Not ready to connect an app?build notes · occasional

All Still Good is being built in public by Eastbase Studio. Leave an email and get the occasional build note and the launch announcement — nothing else.

No spam, no sharing — a handful of emails a year, opt out any time.

Know if your app is still good.

One free, read-only baseline scan shows you where your app stands today. Continuous monitoring catches what changes after that.

Run the free baseline