FlowWatch

For people shipping with Lovable, Bolt, Cursor, and Replit

Ship the vibe. Keep the login working.

FlowWatch opens your app every day, signs up, logs in, and runs a Stripe test checkout. A light leak scan looks for public env files, source maps, and anon keys that can read rows. If any of that breaks, you get the email before your users do.

Run a free check

How it works

01

Point us at the app

Lovable, Bolt, Cursor, Replit, or whatever generated the repo. We only call https URLs you are allowed to test.

02

Prove you can change it

A DNS TXT record, /.well-known/flowwatch.txt, or a meta tag. Scheduled runs refuse anything unverified.

03

Save a test account

The password is encrypted with libsodium before it is stored, and it is never written to logs.

04

We run it every day

Signup, login, and a Stripe test checkout with card 4242. Live keys abort the run. You get an email if it breaks, and another when it recovers.

Pricing

Pro

$49/mo

Five apps, daily checks, and email alerts.

Choose Pro

FAQ

Will this charge a real card?

No. The worker types the Stripe test card 4242…4242 only after it confirms test mode. A pk_live_, sk_live_, or live Checkout session aborts the run before the card is entered.

Can you read my password later?

The dashboard never shows it back. It is encrypted before insert. Replace it by saving the flow again.

What does the leak scan touch?

It requests /.env and /.git/config, looks for public source maps and key-shaped strings in JavaScript, and, if it finds a Supabase anon key, asks PostgREST for one row per table. Findings mask every secret except the last four characters.

Do I have to verify the domain?

Scheduled runs do. The one-off free check does not, but you still confirm you are authorized to test that URL.