For apps built with Lovable, Bolt, Cursor, and Supabase
Catch your whoops before your customers do.
Paste a URL. WhoopsBot opens it in a real browser and tells you, in plain English, if the page loaded, if the console is yelling, and if a secret key is sitting in the JavaScript.
What the free check looks at
One page, not your whole site. It does not click, sign up, or post forms. That stays on the scheduled flows, which you write yourself.
Did the page load?
HTTP status, final URL, and how long it took to become readable.
Console errors
Exceptions and error logs from the first load.
Broken images and links
Images that fail, and same-site links on that page that return an error.
Secrets in the JavaScript
Supabase service_role, Stripe sk_live_, OpenAI-style keys, and a few other obvious tokens.
Exposed /.env or /.git
A plain request to see if those paths answer with real files.
Security headers
HSTS, CSP, nosniff, clickjacking protection, referrer policy, permissions policy.
1. Describe a flow
“Go to /signup, create an account with a test email, confirm the welcome email arrives.”
2. WhoopsBot runs it
A headless browser follows the steps on a schedule and saves a screenshot.
3. You get a plain-English note
What broke, which step, and a prompt you can paste into Cursor or Lovable.
Free for one daily check. $19 when you need more.
Starter adds email-arrival checks and a weekly report. Pro checks every hour and emails you on every failure.