Resources

Guides

Notes on the failures that show up after a publish. No invented numbers. Each one ends at the free check or a free account.

• Your Lovable app works in preview and breaks after you publish

  Why a Lovable app can work in preview and fail on the published URL, and how to check env vars, Supabase redirect URLs, RLS, API keys, and the production build.

• Uptime is green and signup is broken

  Why a URL check stays green when a signup flow is broken, what a synthetic flow check actually does, and how to set one up in WhoopsBot.

• How to check whether /.env or /.git is public

  How to tell a real public /.env or /.git from a single-page app's HTML fallback, what to do if the files are reachable, and how to rotate what leaked.

• A Supabase service_role key ended up in the browser

  How a Supabase service_role key gets into a frontend bundle, how to find it, how to rotate it, and what Row Level Security does and does not cover.

Free checks

Both tools run the same one-page free check. They do not scan the rest of the site.

• Security headers checker

  Check one public page for the security headers WhoopsBot looks at: HSTS, CSP, nosniff, clickjacking protection, referrer policy, and permissions policy.

• Exposed .env and .git checker

  Check whether one site's /.env, /.git/HEAD, or /.git/config is publicly readable, using WhoopsBot's free check.