Skip to main content

offramp

Is the app you built on Lovable or Emergent safe to keep running, and what would it take to own it? offramp reads your repository and tells you. It is free and open source (MIT).

It checks the things AI app builders keep out of sight:

  • Your database rules. In a typical Lovable app, the browser talks straight to Supabase. Row-level security is the only lock, and offramp replays your migrations to see whether it is on.
  • Your secrets. Keys committed to the repository, or compiled into the JavaScript every visitor downloads.
  • What breaks when you leave. Sign-in, AI calls and URLs that only work while the app runs on the builder's platform.

Three steps​

  1. Run an audit on your repository. It takes one command and needs only Python.
  2. Read the report. Findings are ordered by severity, and each one says what to do.
  3. Fix what it finds. Each check has a page that explains the finding and the fix.

What it never does​

offramp reads files. It sends no request to your running app, needs no account or cloud credential, and changes nothing. Secret values are never copied into the report; findings cite a file and line instead. Nothing leaves your machine.

A clean report is only useful if it says what it could not see, so every report ends with what is not visible from a repository.

Source​

The code, issues and roadmap are on GitHub.