Know your app is ready for real users.
Before launch, Faundr tests your database the way a stranger would, then checks keys, payments, your site, privacy and backups. You get a clear verdict: what’s blocking launch, what’s left before real users, and how to fix each item.
What usually breaks on day one. Catch it before a user does.
A database anyone can read.
The app works fine. But the public key in your frontend lets any stranger read, edit or delete every user’s data.
Faundr checks
- Tested as an anonymous visitor
- And as a different signed-in user
- Every change rolled back instantly
A fake "payment succeeded."
If your app doesn’t verify the webhook signature, anyone can forge a payment notice and get your product for free.
Faundr checks
- Stripe, Paddle, Lemon Squeezy and more
- Webhook signature verified
- Blocks launch if missing
Works locally. Breaks in production.
One env var is missing on your host, and sign-in, payments or email break on the first real visit.
Faundr checks
- Every env var compared by name
- Local, .env.example and host
- Values never leave your machine
One question, one verdict. Get your answer in minutes.
Ask your AI, and Faundr runs every check in order. Your app only changes when you approve it.
You ask
"Can I launch?"
Or run /faundr:launch. It can also run automatically in a pre-release workflow.
Database test
As a stranger
Reads, writes, updates and deletes as a visitor and as another user. Then rolls it all back.
Everything else
Site, payments, privacy
Headers, rate limits, webhooks and your privacy policy.
Verdict
One line on your dashboard
What’s blocking launch, what’s left before real users, and how to fix it.
A one-line verdict. Followed by a prioritized list of what’s left.
The dashboard separates what blocks launch from what can wait a few days. Each item says what it found and links straight to the fix. You decide when to go live.
Not yet: 1 blocker left
5 more to fix before real users.
- No exposed keys or passwordsNo secrets found in your code.View in SecurityReady
- Database locked downToday’s test found 1 hole in your database (see Security).View in SecurityMissing
- No critical security issuesNo open critical issues.View in SecurityReady
- Payments verified by signed webhookStripe: the webhook verifies the signature.Ready
Faundr tries to break into your database. Then rolls everything back.
Using your app’s public key (the one that ships to the browser), it reads every table as an anonymous visitor. Then it tries to write, update and delete, both as a visitor and as a signed-in user who doesn’t own the data. Every attempt is rolled back before it completes.
Database tested: littleshop.supabase.co
Tables tested: 6 · public-key reads: yes · write/update/delete as visitor and as another user: yes (all rolled back)
[critical] Any visitor can read the profiles table (214 rows)
[high] Any signed-in user can modify other users’ rows in the orders table
Fix included
Each hole becomes an issue in Security, with the policy ready to paste:
using (auth.uid() = user_id)
Your key never leaves your machine. The test runs locally and never sends your key to Faundr. You approve it before anything touches the database.
Every env var, right where it belongs. Faundr compares names only. Values stay private.
The #1 deploy mistake: it works locally and breaks in production because a variable is missing on your host. Every session, Faundr compares what your code reads against .env.example, your machine and your host.
| Variable | Read by code | In .env.example | Local | Production (Cloudflare) |
|---|---|---|---|---|
| VITE_SUPABASE_URL | yes | yes | yes | yes |
| STRIPE_SECRET_KEY | yes | yes | yes | no |
| RESEND_API_KEY | yes | no | yes | yes |
Breaks in production. Your code reads STRIPE_SECRET_KEY, but it isn’t set on your host. That part of the app will break in production.
Missing from .env.example. RESEND_API_KEY isn’t in .env.example, so whoever sets up the project won’t know it exists.
Privacy compliance for non-technical founders. It never sees your users’ data.
Faundr reads your code and lists the personal data your app collects and every company it’s shared with. Then /faundr:privacy drafts your privacy policy, terms of use and cookie notice for LGPD, GDPR and CCPA, one at a time, with your OK.
To-do
- Privacy policyMissing
- Terms of useMissing
- Cookie consentMissing
- Account and data deletionReady
- Sensitive dataWarning
- Third parties that get dataReady
Personal data collected
- Name Sign-up screen
- Email login
- SSN or government ID db profiles.ssn
- Address Shipping screen
- Health data sensitivedb intake.allergies
Shared with
- SupabaseReceives: everything in your databasecross-border
- StripeReceives: name, email and payment infocross-border
- Google AnalyticsReceives: IP address and devicetrackersets cookies
Before drafting, your AI asks for what the code can’t show: who’s responsible, your company or tax ID, a privacy contact email, and how long data is kept after an account is deleted.
After launch, Faundr keeps watching. You’ll know before your users do.
Launch is just day one. Whatever breaks later, someone’s watching.
- Errors, explained
Faundr installs Sentry’s official SDK, pointed at Faundr. No Sentry account needed. Every error shows up in plain language, with how many people hit it.
- Downtime alerts
Your site gets checked every 5 minutes. If it goes down, it shows up as an error on your dashboard.
- Backups you’ve actually tested
Check it off when you test a restore. After 90 days it flips back to Warning and reminds you to test again.
- Your production database, protected
Your agent stops and asks before applying migrations to production. Dropping whole tables or wiping the remote database is blocked.
Your AI builds the app. Faundr checks it’s ready to ship.
On its own, your coding agent calls it done once the app runs on your machine. With Faundr, you know what still exposes data or money before you go public.
FAQ
Does the database test touch my data?
No. Every write, update or delete attempt is rolled back before it completes and touches at most one row. You approve the test before it runs.
Is it Supabase-only?
The database test is. Everything else (keys, payments, headers, rate limits, privacy, env vars) works with any project.
Can I use the privacy drafts as legal documents?
Treat them as a starting point. They’re built from the data your app actually collects, and a lawyer should review them before you publish.
Do I have to run all this manually?
No. Ask "can I launch?" or run /faundr:launch. You can also add the check to a workflow that runs before every release.
Are my code or keys sent to Faundr?
No. Checks run locally. Only findings reach the dashboard, with no key values and no personal data.