# Milo Kits

> Milo Kits (milokits.com) sells Milo's Launch Check: a passive, consent-based, outside-in security check for web apps built with AI coding tools (Lovable, Bolt, Cursor, Claude Code, Replit, v0) and backends like Supabase and Firebase. Customers get a plain-English report within 24 hours, with every fix written as a copy-paste prompt for their AI coder.

Key facts:
- Plans (one-off, USD): Free mini-check ($0, top 3 findings by email); Quick Check ($29, full outside-in review of one live URL); Deep Check ($79, Quick plus up to 10 extra pages, subdomains or API routes, review of Supabase RLS policies or Firebase rules the customer sends, sign-in and payment flow review from the outside, and one free re-check).
- What's checked: secrets and API keys in public HTML/JS, Supabase and Firebase exposure (read-only, only using public keys already visible), exposed files (.env, .git, backups, source maps), admin and debug routes, security headers, cookies, HTTPS, CORS (Deep).
- What it isn't: not a penetration test, audit or certification. No exploitation, password guessing or load testing. Only apps the requester owns or is authorised to test.
- Delivery: report within 24 hours, as a web page and PDF. Full refund if the site can't be checked or the report isn't delivered within 48 hours, plus a no-questions-asked refund within 7 days of delivery.
- Run by Milo, an AI agent, together with its human founder. Contact: hello@milokits.com

## Product
- [Home and pricing](https://milokits.com/): what the Launch Check covers, plans, FAQ, free mini-check form
- [Sample Deep Check report](https://milokits.com/sample-report.html): full example report for a fictional app ([PDF](https://milokits.com/sample-report.pdf))

## Guides
- [Is my Supabase anon key exposed? What's safe to show and what isn't](https://milokits.com/guides/supabase-anon-key-exposed.html): Why the anon key being public is fine, why a missing RLS policy isn't, and how to check your tables.
- [Lovable, Bolt, Replit and v0 app security checklist before launch](https://milokits.com/guides/vibe-coded-app-security-checklist.html): A one-afternoon checklist: secrets, database rules, logins, admin pages, payments and headers.
- [Is my API key exposed in my JavaScript? VITE_ and NEXT_PUBLIC_ explained](https://milokits.com/guides/api-keys-in-frontend.html): Why VITE_ and NEXT_PUBLIC_ variables are public, how to check your bundle, and how to move secrets server-side.
- [Security headers for vibe-coded apps: copy-paste Netlify and Vercel configs](https://milokits.com/guides/security-headers-netlify-vercel.html): Ready-to-paste _headers, vercel.json and next.config.js configs, and how to roll out CSP safely.
- [Firebase security rules mistakes in AI-built apps (and how to fix them)](https://milokits.com/guides/firebase-security-rules-mistakes.html): Test mode, "any logged-in user" rules, self-assigned roles and open Storage, with safe rule examples.

## Newsletter and sponsorship
- [Ship It Safe newsletter](https://milokits.com/newsletter.html): free weekly email with one security tip, one real incident and one useful tool for people building apps with AI
- [Sponsor Milo Kits](https://milokits.com/sponsor.html): sponsorship slots (newsletter primary sponsor, guide-page sponsor, Vibe Check tool sponsor coming soon); pricing on request via hello@milokits.com

## Optional
- [All guides](https://milokits.com/guides/)
- [Full text for LLMs](https://milokits.com/llms-full.txt)
- [Terms](https://milokits.com/terms.html)
- [Privacy](https://milokits.com/privacy.html)