About

I'm Seth. I built this after
I found my own database open.

I shipped an app built with AI. It worked, people used it, and I felt good about it for about three weeks. Then I went looking at something unrelated and found that the database rules were off — anybody who knew where to look could read rows that weren't theirs. No one had. That was luck, not design.

What bothered me wasn't the mistake. It was that nothing had told me. The app ran, the tests passed, the assistant that wrote the code had never once said "by the way, this table is readable by the whole internet". There was no moment where I could have found out short of going looking, and I only went looking by accident.

So I built the thing I wanted that afternoon: something that reads what an app is already showing the public and says, plainly, what's open. Then a course for closing it, because a list of problems with no instructions is just a worse feeling. That's all this is. I'd rather you found out from a scan than from a stranger.

Seth Ricks · Northslate LLC · Utah. A photo is going here; the wordmark is holding its place until I take one I don't hate.

What this is

A free scan that reads what your app already shows anyone who visits it. A free thirteen-question check for the things no scan can see from outside. A weekend course with prompts you hand to the same AI that built the app. And, if you want it, me reading your specific app and writing back.

What it isn't

Not a penetration test — nobody attacks your app. Not a compliance artifact — no assessor will accept it. Not monitoring — nothing watches your app after you close the tab. And not a promise that you're safe, because there is no honest version of that sentence and anyone selling you one is selling something worse than your current ignorance.

The rules I hold myself to

These aren't aspirations. They're constraints in the code, and if you catch me breaking one, write to me and I'll fix it.

Never a real key on screen. If the scan finds something shaped like a secret, you get the type, the file, and how many — never a character of the value, not even the first few. A prefix is enough to identify a key, and a list of key prefixes is a target in its own right.
Never someone else's app. Every scan requires you to say you own it or have written permission, and that's checked on the server, not just in the browser. Checking somebody else's app without permission is illegal, and I won't do it for you.
Never "guaranteed". I won't tell you your app is secure. I'll tell you what I looked at, what I found, and what I'd fix first. The most I'll claim is that this closes the gaps that actually get people.
Consequence, not method. Findings describe what goes wrong, never how to make it go wrong. There are no payloads on this site, and there won't be.
The check stays free. The scan, the thirteen questions, every finding in full, and the five audit prompts — free, no email required, permanently. I sell what comes after the list, not the list.
No third-party requests in your browser. No analytics script, no pixel, no session recorder, no font CDN. Open your network tab and check — which, on a security site, feels like the minimum.

How to reach me

[email protected]. It's me reading it. If you found a problem with this site itself, that's the address for it too, and I'd rather hear it from you than not hear it.

SecureBySunday is a product of Northslate LLC, a Utah limited liability company. What gets collected and why is on the privacy page; how the grading works is on the methodology page, in full, with the numbers.

I'm Seth. I built this afterI found my own database open.

What this is

What it isn't

The rules I hold myself to

How to reach me

I'm Seth. I built this after
I found my own database open.