1
Scan the public surface
Paste a URL. You get a 0–100 score, plain-English findings, and a prompt your coding agent can apply.
For people shipping with Lovable, Bolt, Cursor, and Replit
Catch a broken signup before your customers do.
You deploy several times a week and there is no QA person. FlowCheck reruns the paths that make you money — signup, login, checkout — and emails you a screenshot plus a fix prompt when one dies.
2
Describe the money path
“Sign up with a new email, confirm it, land on the dashboard.” An agent turns that into steps. Every plan runs them once a day. Starter and Pro also run them when a deploy webhook fires.
3
Get the break, not a stack trace
On a real failure: one email, the screen where it stopped, and a prompt. A flake is labeled and does not page you.
Example alert
Signup with a new email failed
Stopped at “Open the confirmation link”. The confirmation page returned 404. The step was retried once and failed again, so this is not marked flaky.
The monitored flow "Signup with a new email" failed. It stopped at: Open the confirmation link. Page returned HTTP 404. Fix the app so a new user can confirm and land on the dashboard. Do not skip email confirmation to make the check pass.
What the free scan looks for
- Stripe secret keys, OpenAI keys, and Supabase service_role keys in public JavaScript
- Whether common Supabase tables answer a read-only request with only the anon key
- HTTPS, HSTS, clickjacking protection, and the other headers generated apps forget
- A public .env file or a source map that includes your original source
- CORS that reflects an unrelated site
Then sign up and keep the signup path itself under a schedule.
Simple plans
Every plan is checked once a day. Starter and Pro also run when a deploy webhook fires. Prices are USD per month, before tax. If you charge customers in the US or EU, set up Stripe Tax only after you have an active registration — Stripe collects nothing until one exists.
Free
$0/mo
Watch the one path that pays you.
- 1 monitored flow
- Daily runs
- Email alert with a fix prompt
- Free passive security scan
Starter
$19/mo
Run the important paths after every deploy.
- 5 monitored flows
- Daily runs and a run on every deploy
- Disposable inboxes for confirmation emails
- Email alert with a screenshot and fix prompt
Pro
$49/mo
Cover signup, login, and checkout across a few apps.
- 20 monitored flows
- Daily runs and a run on every deploy
- Disposable inboxes for confirmation emails
- Email alert with a screenshot and fix prompt
Questions
Is the free scan an attack?
No. It requests the public page, same-origin scripts, a few well-known paths, response headers, and — only if it finds a Supabase anon key — a read-only row from common tables. It does not submit forms, guess passwords, or write data.
What happens when a check is flaky?
A failed step is retried once. If the retry passes, the run is labeled flaky and no alert email goes out. An alert is sent only when the retry fails too.
How often does a flow run?
Once a day on every plan, including Free. Starter and Pro also run when your deploy webhook is called, which is how a check happens between mornings. Opening the dashboard catches up that account if the daily job did not finish it.
Can a Lovable or Vercel deploy start a run?
Yes, on Starter and Pro. Each project has a webhook URL. Free keeps the URL and does not start a run from it.
What is the fix prompt?
A short brief for the coding agent that built the app: the flow you described, the step that stopped, and what was on the screen. Paste it into Cursor, Lovable, Bolt, or Replit.