Question 1

What do you see when I connect my GitHub repo?

Accepted Answer

We read the things that decide whether your app is safe: your database migrations, your edge functions, your dependency lockfile, your config, and a handful of files like index.html. We read them during the scan and we do not keep a copy of your code. What gets stored is the result — the findings, the scores and a summary. A finding names a file or a table, and sometimes quotes the one line it is pointing at, because a fix you cannot locate is not a fix.

Question 2

Do I need to be technical?

Accepted Answer

No. That is the entire point. Every finding is one sentence in plain English, ranked by how much it actually matters for your app, and every fix comes as text you paste into the AI builder you already use. No terminal, no config files, no DevOps vocabulary.

Question 3

Which builders do you support?

Accepted Answer

All of them, because we read your repository and your live app rather than the tool that produced them. Lovable, Bolt, v0, Cursor, Replit, or hand-written code — if it is on GitHub and it runs, we can scan it. Fixes are phrased for whichever builder you tell us you use.

Question 4

Who is behind AppSitter?

Accepted Answer

One engineer with ten years of production DevOps, running AppSitter as a registered small business in Germany. You are not talking to a support queue. The Impressum has the full legal details, and hello@appsitter.app reaches a person.

Question 5

What is the difference between the free URL scan and connecting a repo?

Accepted Answer

The URL scan needs no account: paste your live address and we check what the outside world can see — security headers, keys shipped in your JavaScript bundle, and whether your database answers anonymous requests. Connecting the repo is the real scan: it also reads your migrations, your edge functions, your dependencies and your email DNS records, which is where the serious problems live.

Question 6

How long does a scan take?

Accepted Answer

A URL scan is a few seconds. A full repository scan is typically 15 to 30 seconds, depending on how many migrations and functions your app has.

Question 7

What do you actually check?

Accepted Answer

The things that get AI-built apps in trouble: database tables anyone on the internet can read, API keys committed where they should not be, endpoints that accept writes without asking who you are, publicly listed storage buckets, and dependencies with known published vulnerabilities. Plus the quieter ones nobody warns you about — table links with no index, which turn into slow pages and a growing database bill, and missing DNS records, which put your signup emails in spam.

Question 8

You flagged something that is intentional. Am I stuck with it?

Accepted Answer

No — argue with it. Paste your reasoning, or your AI builder's explanation, and a skeptical reviewer judges whether it genuinely establishes that the finding is not a risk for your app. If it does, the finding is set aside and stops counting against your score. If it only establishes half of it, you get told exactly which gap is left and a follow-up prompt that closes just that gap without undoing your design.

Question 9

Will scanning break anything or slow my app down?

Accepted Answer

No. We read your repository through GitHub's API and make a small number of ordinary requests to your live URL, the same kind any visitor makes. Nothing is written to your app, your database or your code.

Question 10

How do the fixes work?

Accepted Answer

Each finding comes with a copy-paste prompt written for your builder. You paste it, your builder makes the change, you re-scan to confirm the finding is gone. The prompt tells the builder to verify the problem exists before changing anything, so it cannot confidently 'fix' something that was never broken.

Question 11

What if the fix is not something my builder can do?

Accepted Answer

Then you get the actual thing instead of a prompt that could never work. A missing DNS record is a DNS record to add at your registrar, not a prompt for an AI that has no access to your domain.

Question 12

What are guardrail files?

Accepted Answer

Files like AGENTS.md, CLAUDE.md or Cursor rules that live in your repository and tell your AI builder the rules of your project — so the same class of problem stops coming back every time you ship a feature. Included on every paid plan.

Question 13

What do I get for free, and forever?

Accepted Answer

The free plan watches one app with 3 scans a month, run whenever you want. You see every finding, in full, plus the first fix. No card, and the URL scan needs no account at all.

Question 14

What does a paid plan add?

Accepted Answer

Solo is $29/mo: the same one app, but re-scanned automatically every week, watched around the clock with email alerts when it goes down, and every fix engineered for your builder instead of just the first one — 6 fix generations a month, guardrail files, and a monthly health certificate. Autopilot adds more apps, Autopilot Pro ($99/mo) adds daily scanning, migration readiness and cost audits across up to 15 apps.

Question 15

Can I cancel any time?

Accepted Answer

Yes, from the billing settings in your portal, in two clicks. Your plan stays active until the end of the period you already paid for — the portal shows you that date — and then drops to Free. No further charges, no email required, no retention call.

Question 16

Is there VAT on top?

Accepted Answer

No. AppSitter is run as a German small business under §19 UStG, so no VAT is charged or shown. The price you see is the price you pay. Prices are in USD.

Question 17

Is my scan result public?

Accepted Answer

No, never by default. Your findings are yours. There is a switch in your project settings that creates a public, sanitised verification page you can link from your own site — it shows the score and what was checked, not your findings or your file paths — and it only exists once you turn it on.

Question 18

What happens to my data if I delete my account?

Accepted Answer

It is deleted. You get a 30-day window to change your mind, and after that everything tied to your account is removed: your repositories, every scan and finding, your reports, your usage records and your subscription row. Not anonymised, not archived — deleted. The only thing kept is the record that you asked, which is how we can prove the request was honoured.

Question 19

Do you train AI on my code?

Accepted Answer

No. Your code and findings are sent to Anthropic's API to produce your findings and your fixes, and that is where it ends. We do not train models on your data and we do not sell it. The Privacy page and the DPA spell out the details.

Everything you'd ask before trusting us with your app.