Find what your AI-built site forgot.
Built it with Lovable, Bolt, Cursor or v0? LaunchPal reads the site you just shipped and tells you what to fix, in plain English, with a prompt you can paste straight back into your editor.
KES 500, one payment, no subscription. Card, M-Pesa, Airtel Money or bank transfer.
What it feels like
One scan, one score, a list you can actually work through.
Stripe secret key in client code
Shown as sk_live_...0123. The value is masked, and the fix prompt walks you through rotating it.
Contact form collects nothing
The action points at a placeholder, so every message is lost silently.
No favicon
The tab shows a generic globe, which reads as unfinished to a first-time visitor.
What it checks
Free scans cover the whole page. Pro adds deeper checks on sites you prove you own.
Leaked secrets
OpenAI, Stripe, Paystack, AWS, Supabase service role, Firebase and generic high-entropy tokens, in inline scripts and bundles.
Forms
Missing labels, no validation, no spam protection, placeholder endpoints, silent failures.
Launch basics
Title, meta description, social preview tags, favicon, leftover lorem ipsum.
Security headers
HTTPS, HSTS, content security policy quality, framing protection, mixed content.
Mobile and accessibility
Viewport, tap target sizes, alt text, heading order, real colour contrast ratios.
SEO
Title and description length, a single H1, canonical, accidental noindex, robots.txt, sitemap, structured data.
Console and links
Errors thrown while loading, failed resources, internal links that 404.
Exposure, on verified sites
Readable .env and .git, open Supabase or Firebase, wildcard CORS, API routes that answer without a login.
How it works
No account needed to scan your first site.
Add LaunchPal to Chrome. It asks for access to the current tab only when you click the icon.
The scan runs locally. A score, a severity list, and one fix prompt per issue.
Each prompt names the file, the risk and the steps, in the format Cursor, Claude Code and Lovable understand.
Add one meta tag, and Pro checks for readable .env files, open databases and API routes that answer without a login.
Pricing
Pay by card, M-Pesa, Airtel Money or bank transfer. Cancel any time.
- Every fix prompt, every scan
- Deep scans on sites you own
- Saved history and exports
- KES 12,000/year if you prefer
Prices in Kenyan shillings. Payments are processed by Paystack. Pay by card, M-Pesa, Airtel Money or bank transfer. Refunds within 14 days, no questions.
Privacy, in one paragraph
Scans run inside your browser. Page content, page source, found secrets, URLs and findings never reach our servers. The only call the extension makes is a licence check, which sends a licence key and a random install id. No analytics, no tracking pixels, no third-party scripts on this site.
Questions
Does it work on any site?
Yes for free scans, on the page you have open. Deeper scans only run on origins you verify by publishing a token, which is what keeps them from being used against someone else's site.
Do you see my API keys?
No. Detection happens locally and the report masks the value, so even you only see something like sk_live_...0123. Nothing is uploaded.
What does a deeper scan send?
Read-only GET and HEAD requests to your own site, at most 40 per scan, 350 ms apart, with a stop button. No writes, no POSTs, no credentials.
Which tools does it cover?
Anything that runs in a browser. The fix prompts are written for Cursor, Claude Code and Lovable, and read fine in any assistant.
Can I move my licence to another browser?
Yes. Tap Deactivate in Settings, then activate on the other browser. A key allows 2 active browsers.
Can I get a refund?
Within 14 days of purchase. Email maverick.develops@gmail.com and it is refunded. No form, no questions.