Why is my app broken?
Paste the address of your deployed app. We load it the way a visitor would and tell you the most likely cause, with the evidence that produced it. About a minute, no signup, and nothing about your app is changed.
We load the page the way any visitor would. Nothing is changed, and we never probe an app you have not proven is yours.
What the check looks at
- Your server
- Whether it answers at all, and what it answers with
- Your build
- Whether the page is loading JavaScript that is no longer there
- Your environment
- Whether the build shipped without the variables it needs
- Your database
- Whether queries are being rejected, or quietly returning nothing
- Your own API
- Whether routes are missing from the deploy, or crashing
- Your secrets
- Whether any key ended up in public JavaScript
What it cannot see
Worth reading before you trust the result. A check that runs from outside sees what any visitor sees, and no more.
- Whether an empty result means your policies are blocking the read or the table is genuinely empty — both look identical from outside
- Anything that only happens for signed-in users
- Whether the values of your environment variables are correct, as opposed to present
- What a change to your app would touch — that needs the code
When the evidence does not support a conclusion, the result says so rather than guessing. Your app is down, and a wrong answer costs you more than no answer.
Not sure which symptom you have? Browse what usually breaks. Got one key to check? Anon or service_role. Wondering what ships to the browser? Check your variable names.
What this does with your app
Do I need to give you access to my code?
No. This check loads your published app the way any visitor would. It reads the page, the JavaScript it references and its response headers — all of it already public. Connecting a repository is a separate step you only take if you want Refinar to fix what it found.
Will this change anything about my app?
No. Every request is a read. We do not log in, submit anything, or call your API beyond loading the page itself.
Can I check an app that is not mine?
You can run the check on any public address, but it deliberately stays passive: it never probes routes, tests your database, or tries credentials. Those checks exist, and they only run once you have proven the app is yours. We do not want to be the tool someone uses to scan a stranger's app.
Why does it sometimes say it could not tell?
Because that is often the truth. A page that loads and then fails in the browser looks healthy from outside, and so does a database quietly refusing to return rows. When the evidence does not support a conclusion, saying so is more useful than a confident guess — your app is down, and the wrong lead costs you a day.
It says my app is fine, but it is not.
Then the cause is somewhere an outside check cannot reach: behind a login, in your database policies, in server code, or affecting only some users. Those need the code, which is what the repository step is for.
Is this a security scan?
No. It reports a leaked key or a public .env file if it trips over one, because you would want to know immediately, but it is not a vulnerability scanner and does not claim your app is secure. It answers one question: why is this thing not working.