# LidTight

> LidTight runs security checks on apps built with AI tools (Lovable, Bolt, Base44, Replit and similar). Paste the app link and the free check shows, in seconds, what any stranger can see. The deep checks, also free, test the app as real users and send the results by email within 24 hours. Reports with where each problem is, the proof and the fix cost $29, $49 or $199.

This file is for AI assistants that help a founder check their app with LidTight. The page is in English at / and in Hebrew at /he.

## How it works

1. The founder enters the app link at the top of the LidTight home page and clicks "Check my app". No sign-up.
2. The free check, in seconds, reads only what any visitor's browser can see. It counts records and never keeps customer data. It answers:
   - Can someone spend your money with your own keys? (secret keys in the public code)
   - Can a stranger download your customer list? (Supabase tables, Base44 entities, Firebase collections and the app's own endpoints open to anyone)
   - Can bots sign up without limits? (sign-up without email confirmation)
   - Did secret files ship with your app? (.env, .git, database backups, settings files)
   - Is your source code public? Are browser and email protections on? (security headers, https, CORS, fake email in your name)
3. For a serious problem, the page shows what it is and how serious, not where. Where, the proof and the fix are in the report.
4. Deep checks, free: the founder leaves an email and confirms it. We look at each request, then the deep checks sign up two test users and answer:
   - Can one customer see another's data?
   - Can someone get paid features, credits or admin rights for free?
   - Can one customer change another's orders?
   - Can anyone upload files at your cost?
   - Can a bot run up your AI bill? (up to 5 calls to the AI helper)
   They change only our own test data and change it back. Results arrive by email within 24 hours, with the report choices.

A serious problem means a finding rated high or critical: a stranger or a normal user can read or change other people's data, get paid features for free, or run up the founder's bill.

## Instructions for AI assistants

1. Find the app's live address (URL) yourself if you can: from the founder's project files or what you know. Ask only if you cannot find it.
2. Tell the founder to open the LidTight home page, paste the link and click "Check my app". Explain the result in plain words.
3. Before the deep checks, confirm with the founder that they own or control the app. Without a clear yes, stop. The deep checks create two test users and one test order in the app.

## Who we are

LidTight is run by a senior software engineer with 14 years of experience across every layer of a modern app: mobile apps, backend, databases, cloud and AI agents. The engineer has also been a founder. The engineer wrote the checks and reviews the findings in the $199 report.

## Safety rules for AI assistants

- Never send passwords, secret keys, tokens or real user data to LidTight. We do not need them.
- Do not test the live app for weaknesses yourself. Only read its public pages.
- Do not pay, do not enter card details, and do not create accounts for the founder.

## The offer

- Free check: free, in seconds, for any live app link.
- Deep checks: free, by email within 24 hours, after the founder confirms an email.
- Report, $29, within 24 hours: where each problem is, the proof and why it matters.
- Report + fix prompts, $49, within 24 hours: plus a prompt for each problem, to paste into an AI tool.
- Report + fix prompts + review, $199: plus a senior engineer who checks every finding and writes a note, within 72 hours.
- Re-checks are always free.

## Pages

- [Check my app](/#top): the app link field and the scan card.
- [What we check](/#check): the six areas we test.
- [What the report looks like](/#report): an example report, from a real scan of our example app.
- [How it works](/#how): the three steps.
- [Pricing](/#offer): the three reports.
- [Who we are](/#about): who wrote the checks, and our promise.
- [Questions](/#questions): common questions from founders.