# FlawPilot > FlawPilot is the AI app security & SEO audit platform. It checks any public URL across four pillars - Security, Performance, Infrastructure, and SEO - and returns a prioritized fix list in under two minutes. Two further features stand alongside it: Site Health crawls every reachable page and scores each one with Google Lighthouse, and source code scanning reads a connected git repository for insecure code, exposed secrets, vulnerable dependencies, and code quality. The URL scan needs no login and no server access, and uses only publicly accessible signals; the repository scan is opt-in and read-only. Built by Logicwind. The primary audience is non-technical founders, vibe coders, and teams who shipped with AI/no-code tools (Lovable, Bolt.new, v0, Cursor, Replit) and need to know if their app is production-ready before a launch, an investor meeting, or their first enterprise customer. FlawPilot is free to use. The single-URL scan needs no account; Site Health and repository scanning are used from the dashboard. ## Core product - [Run a free scan](https://flawpilot.com/): Accepts any public URL. Returns a scored report across the four pillars in under two minutes. - [How it works](https://flawpilot.com/how-it-works): How FlawPilot turns a URL into a prioritized fix list across the four pillars. - [Site Health](https://flawpilot.com/site-health): Crawls your whole site and scores every page on performance, accessibility, best practices, and SEO, so a slow template buried deep in the site cannot hide behind a healthy landing page. - [Scan your source code](https://flawpilot.com/code-scan): Connect a git repository and scan it for insecure code, exposed secrets, vulnerable dependencies, and code quality. Separate from the live-site scan, with each dimension scored on its own. - [Scheduled scans](https://flawpilot.com/scheduled-scans): Run quick scans and code scans daily, weekly, or monthly and Site Health crawls weekly or monthly. URL schedules require a domain verified by DNS TXT record. Alerts go by email only when a run fails or a score or critical/high finding count gets worse. - [Upcoming features](https://flawpilot.com/upcoming): The product roadmap. ## Developer surfaces - [REST API reference](https://flawpilot.com/api-docs): API-key-authenticated HTTP endpoints for every surface - trigger a URL scan, a repository code scan or a Site Health crawl, poll status, and pull findings. - [Connect over MCP](https://flawpilot.com/mcp-connect): A remote MCP server exposing ten tools, so Claude, ChatGPT, Gemini or Cursor can run scans and read findings without leaving the editor. - [Connect to Gemini](https://flawpilot.com/mcp-connect/gemini): Step-by-step guide to adding FlawPilot as a custom connected app in the Gemini Spark tab. - [CI/CD integration](https://flawpilot.com/ci-cd): Copy-paste workflow files for GitHub Actions, GitLab CI and Bitbucket Pipelines that run a scan on every deploy and fail the build when a pillar score drops below a threshold. ## What FlawPilot checks - [Security](https://flawpilot.com/use-cases/security): HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP), TLS/SSL certificate and protocol grade, DNS/email authentication (DMARC, SPF, DKIM, CAA), cookie security flags, and leaked-secret signals in public JS bundles. - [Performance](https://flawpilot.com/use-cases/performance): Core Web Vitals (LCP, CLS, INP), TTFB, page weight, render-blocking assets, image optimization, and caching posture - graded against current Google thresholds. - [Infrastructure](https://flawpilot.com/use-cases/infrastructure): CDN and WAF coverage, DNS record health, exposed services, subdomain hygiene, and edge configuration. - [SEO](https://flawpilot.com/use-cases/seo): Title tags, meta descriptions, canonicals, robots.txt, sitemap, structured data (JSON-LD), crawlability, and AI-crawler access signals. ## Site Health (whole-site crawl) A separate feature from the single-URL scan. FlawPilot crawls every page reachable by following links from the URL you give it and scores each one with Google Lighthouse, then rolls the pages up into one site-wide number. Nothing to install, no repository access, no agent - the crawl runs from the outside, the way a visitor or a search engine would. - Performance: Core Web Vitals, render-blocking resources, image delivery, and load speed. - Accessibility: contrast, labels, landmarks, heading order, and keyboard reachability. - Best Practices: console errors, deprecated APIs, insecure requests, and browser warnings. - SEO: crawlability, metadata, link text, and mobile friendliness. Pages behind a login, or with no inbound links, are not crawled. Scores come straight from Lighthouse, so they are comparable with PageSpeed Insights. ## Source code scanning (connected repository) A separate feature from the live-site scan, and opt-in: you connect a git provider and assign a project and branch before a repo can be scanned. Four independent scans, each scored on its own, so a clean dependency tree does not mask a hardcoded secret. - Code security: injection, XSS, weak cryptography, path traversal, and unsafe deserialization, matched against your source. - Exposed secrets: API keys, tokens, database passwords, and private keys - across your full git history, not just current files. - Vulnerable dependencies: known CVEs in the packages your project depends on. - Code quality: maintainability and correctness issues alongside the security findings. Scans are started manually through a 3-step wizard, or run on a daily, weekly, or monthly schedule. There is no push-triggered scanning yet. ## Platform fingerprinting FlawPilot detects the platform a site was built with and shows platform-specific findings and fix steps: - [Lovable](https://flawpilot.com/platforms/lovable) - [Bolt.new](https://flawpilot.com/platforms/bolt) - [Cursor](https://flawpilot.com/platforms/cursor) - [Replit](https://flawpilot.com/platforms/replit) - [v0 by Vercel](https://flawpilot.com/platforms/v0) ## Who it is for - Non-technical founders who need to know if their app is safe before an enterprise deal or investor demo. - Vibe coders who shipped with Lovable, Bolt.new, v0, Cursor, or Replit and have never run a security check. - Agencies and freelancers running instant audits for prospective clients. - Teams doing pre-launch checklists (Product Hunt launches, enterprise RFPs, VC pitches). ## Company - [About Logicwind](https://www.logicwind.com): The software development agency that built FlawPilot (Logicwind Ventures Pvt. Ltd.). - [Privacy policy](https://flawpilot.com/privacy): How FlawPilot collects, uses, and protects information. Public signals only; no credentials stored. - Contact: hello@flawpilot.com ## Notes - The live-site scan and Site Health use only publicly accessible signals; results do not reflect live server traffic or authenticated pages. Neither touches your server, code, or credentials. - Source code scanning is a separate, opt-in feature: you connect a git provider and FlawPilot reads the repository to report on it. Nothing is auto-applied or merged without human review.