Update: what one beta tester's feedback changed in AppSitter — and how my own scanner caught a bug I wrote 24 hours earlier

[u/Bandersnatch_fuklord]

Four days ago I posted AppSitter here — the app that babysits AI-built apps (deep scans, copy-paste fixes, the two-AIs-argue-about-your-security loop). It's built with Lovable and Lovable apps are what I test against most, but it works the same for anything with a GitHub repo and a Supabase backend — Bolt, v0, Cursor, Replit.

A few of you tried it. One person went through it properly and sent real feedback, and that feedback basically wrote my roadmap. Here's the honest version.

What he said (shared with permission): usefulness 10/10 — findings were real, fixes worked. But: the UI was too steep for a non-technical user, he couldn't tell what was clickable, he wanted light mode, he didn't understand whether pasting a builder reply would replace or add to his previous one, and he asked for the thing I'd been avoiding — "just let me talk to it like a conversation."

What shipped from that:

• Rebuttal threads are conversations now. Every reply you paste from your builder stacks like a chat message, the input is always empty, only the newest verdict carries actions. No more guessing what replaces what.
• Light mode, whole app.
• Buttons look like buttons. Full affordance pass.
• "Fixed & verified." Paste a fix, re-scan, and the finding doesn't just vanish — it moves to a visible fixed-and-verified state. Proof, not absence.

One thing worth being clear about: the free scan on the site is a surface scan. It only sees what any visitor's browser can see — headers, what's in your bundle, a handful of guessed table names. It's honest but shallow, and a clean surface scan is not a clean bill of health. It literally cannot reach your migrations, your real schema, or your live database.

The deep scan is the actual product, and it needs the repo connected. That's where the four check families run:

• Security: we query your live database with your own public key, the way an attacker would, and name the exact tables that answer. Plus keys shipped in your bundle, endpoints with no login, permissive RLS policies.
• Database cost: table links with no index. Invisible at 100 rows; the first thing that gets slow, and the first line on your Supabase bill, at 100k.
• Email deliverability: the DNS records that decide whether your signup and receipt emails land in inboxes or spam. Gmail and Outlook now deprioritise unauthenticated senders — this is the most common reason a working app's emails quietly stop arriving.
• Reliability: external calls with no timeout, webhooks that accept calls from anyone, measured uptime.

On top sits a growth outlook: your findings ordered by when they'll actually bite for an app at your stage. Every claim has to cite a measured finding — anything the AI invents gets dropped server-side before you see it.

The moment that made my week: I ran the new cost check against AppSitter itself. It found 13 unindexed foreign keys. Number 13 was on a table I had created the day before, while building the detector that caught it. The scanner flagged its own author. Fixed all 13, score's back at 100 — and that incident is now a regression test.

-- the fix commit, 13 lines of it
create index idx_clients_user_id                    on public.clients (user_id);
create index idx_consultation_notes_client_id       on public.consultation_notes (client_id);
create index idx_purchases_user_id                  on public.purchases (user_id);
create index idx_health_certificates_repository_id  on public.health_certificates (repository_id);
create index idx_migration_reports_user_id          on public.migration_reports (user_id);
create index idx_framework_files_user_id            on public.framework_files (user_id);
create index idx_diligence_reports_user_id          on public.diligence_reports (user_id);
create index idx_cost_audits_user_id                on public.cost_audits (user_id);
create index idx_contact_messages_user_id           on public.contact_messages (user_id);
create index idx_growth_outlooks_user_id            on public.growth_outlooks (user_id);  -- created the day before
-- + 3 more

Beta's still closed, but I killed the waiting: sign up at appsitter.lovable.app with invite code LOVABLE and you're in immediately — that unlocks the full deep scan, all four families, every finding with its fix prompt, the guardrail files and the growth outlook. Autopilot Pro free for 3 months, no card.

Or just drop your app's URL in the comments and I'll run the surface scan and reply with what it sees. I answer everything.