Built your app with Lovable, Bolt, v0, Replit, Cursor or Claude Code? 7IT Guard checks it from the outside, on your own machine, and tells Claude what to fix before you ship. Guard Pro keeps watching after you do.
The check runs on your machine and reads only what the public internet sees. Nothing about your app is sent to 7IT. No account.
You shipped something real with AI. These are the questions that keep founders up at night, and what 7IT Guard and Guard Pro do about each one.
Each category gets a score out of 100 and the app gets a grade from A to F; anything exposed right now caps it. Findings land in two lists: fix before shipping (something is exposed or broken now) and fix soon (hardening, speed, accessibility, search).
Whether the app forces a secure connection and sends the protections browsers use to stop injected scripts, clickjacking and leaky cookies.
HTTPS and the http-to-https redirect, HSTS, Content Security Policy (and whether it still allows inline scripts), clickjacking and MIME-sniffing protection, referrer and permissions policy, cookie flags, mixed content.
Whether your source code or a private key is readable by anyone who opens the app.
A public JavaScript source map; on your own app, keys shaped like OpenAI, Anthropic, Stripe, GitHub, AWS or a Supabase service key in the code sent to browsers, reported by type and file, never the value.
What a stranger can reach without signing in: settings files, backups, and the database rules behind the app.
An .env file, a .git folder, backups and admin tools. When the app uses Supabase or Firebase, the guided Security Advisor step in your own account. This check never reads your data.
Whether the app’s mail lands in inboxes and whether someone else could send mail in its name.
SPF, DKIM and DMARC on the app’s own domain. Skipped on shared addresses such as myapp.lovable.app.
How fast the first page answers and how much it makes a phone download.
Time to first byte, HTML weight, compression, script weight, render-blocking scripts and caching. Google PageSpeed too, with your own key.
The basics that let everyone use the app, including people with screen readers.
Page language, image text alternatives, form labels, button and link names, zoom and landmarks. Contrast cannot be judged from outside, and the report says so.
Whether search engines and link previews can read the app, and whether a development setting is hiding it.
Title, description, canonical, link previews, a noindex left on from development, robots.txt and the sitemap.
Whether the address works the way visitors type it, and whether the certificate is about to run out.
Home page status, certificate validity and expiry, redirect chains, real 404s, and whether www and the bare domain both answer.
A no-cost check on this site: it reads only what your site already shows to everyone, never your database, then walks you through Supabase’s own Security Advisor with a ready prompt for your AI builder. Guard Solo and Guard Pro re-check after every deploy and remind you each month.
7IT Guard is a Claude Code plugin with one readable Node script inside. The requests go from your computer straight to your app, the way a visitor’s would. 7IT never sees the address, the results or your code.
Two commands. No account, nothing to set up.
Or run /7it-guard:check myapp.com. A grade, a score per category and a ranked fix list, in about two seconds of checking.
/7it-guard:fix works through the findings in your repository, most severe first, and asks before every change. The visual report opens from a link that keeps the results after the "#", which browsers never send.
I built my app with:
Add the marketplace and install. The check needs Node.js 18 or newer and nothing else.
/plugin marketplace add XLSV777/7it-guard
/plugin install 7it-guard@7it-guardThen check your live app, or just ask Claude whether it is ready to ship:
/7it-guard:check myapp.comTo unlock the deep checks on your own app, the report prints a token. Add it to the home page as a meta tag (or as a file at /7it-verify.txt), deploy, and check again.
<meta name="7it-site-verification" content="7it-verify-...">The 7Maps marketplace lists 7IT Guard too.
/plugin install 7it-guard@7mapsAny MCP client can use the hosted fallback, https://7it.co.il/mcp?set=guard. It runs the public checks on 7IT’s server, so the address is sent to 7IT.
Their own plugin listings are coming soon. Today, run Claude Code in your editor’s terminal.
The check tells you where you stand today. Guard Pro keeps watching after every deploy, explains what changed in plain words, and keeps the evidence. It opens soon.
Illustrations drawn in the control room’s design with sample data. No customer data.
Your app is checked from outside every 5 minutes, day and night: answering, certificate, security settings, DNS.
A snapshot at every deploy, the changes in plain words, worse first, kept in a signed history you can verify.
A weekly look at what can run up your bill: open AI endpoints, sign-ups with no bot check, pages that skip the cache.
Guard recognises your hosting, database, AI and email providers, reads their status pages, and tells you when an outage is theirs.
If you choose, a public page and the 7IT Proof seal show customers and investors the app is independently monitored, every check signed. Off until you turn it on. About 7IT Proof
Status rings for every app, the deploy timeline and the evidence, on your phone, with push alerts you control: quiet hours, mutes, severity.
When something looks wrong, Help checks again from outside and shows the likely causes for your own stack, with the steps at your provider.
A request to a senior engineer, one tap from the control room, with the app’s recent history attached. Lior replies with the details.
Everything in Guard Pro, plus a Launch Review, a senior engineer on call and a monthly call about your app. Limited seats, by request: Lior replies with the details.
The key that opens Guard Pro also opens every paid 7Maps tool, with no daily limit.
Payments, scheduled jobs, the database, sign-ups, AI spend. Ask your AI in one sentence; it proposes the sensors and you confirm. No database password ever leaves your app.
A seal for your footer and a live verification page. Independently monitored by 7IT, every check signed. Not a certification: a record anyone can check.
A cockpit of gauges for every site, widgets you arrange yourself, and an alert that opens the exact steps to fix it. Plain words by default; the technical detail is one switch away.
Illustrations drawn in the app’s design with sample data. No customer data.
The real app, running on a made-up store: Northwind Coffee at shop.northwind.example. Orders flow in, an update removes a browser protection, the afternoon gets slow, a payment service has an outage. Tap everything, or press Play the story to watch a whole day in a minute. No account, and nothing here is real.
Each site as an instrument panel: a status dial, gauges for online time, speed, the safety lock, protection, bill risk and changes, and warning lights like a car’s. A word and a colour, never a code.
Small, medium and large widgets, arranged the way you arrange your phone’s home screen: drag to move, add from a gallery, and a stack that turns to whatever needs you now.
While a site is not answering or a provider it uses has an outage, a live status pill stays at the top and the app icon shows a badge.
This week against last: time online across your sites, updates seen, problems found and problems cleared.
Every alert opens a guide for that exact problem on that site: one step at a time, in plain words, with a ready prompt for the AI that built your app.
Alerts on your phone with quiet hours, mutes, snooze and severity. A tap opens the exact place to look.
Also coming soon: swipe an alert to acknowledge or snooze it, pull to refresh, one search box for sites, checks, alerts and help, long-press menus, sharing the trust page, smooth transitions, large titles, and text that follows your phone’s text size.
Sign in from the plugin, or by proving the site is yours. No paid key, no card, no end date. Everything in Guard Pro is shown in the app, greyed, with “Upgrade to Pro”.
Verify your site in the Guard app and Guard Pro watches it for 14 days, on us. No card. Then it moves by itself to the no-cost Guard app, checked once an hour, and nothing is deleted. Once per website.
Large IT teams run monitoring suites with hundreds of settings. Guard Pro brings the parts that matter to a founder, in plain words.
Coming to Guard Pro
Planned work, once or on a weekly schedule. Checks keep running and recording; alerts wait until the window ends.
Tell Guard what depends on what. When the database is down, you hear about the database, not about every check behind it.
Mark an alert as handled, with a note. If nobody does, it goes on to a second channel.
Charts you can zoom into, this period against the last one, and the numbers as a CSV file.
Time online and every incident of the month, as a permanent signed link you can send a customer. No email needed.
One sensor can watch several numbers, each with its own warning limit and error limit. Yellow comes before red.
Group checks by site or by part of the business. Settings flow down to every check in a group; edit many at once, or clone one.
Guard looks at what your app already uses and suggests the sensors that fit. You confirm each one.
One light for a whole flow, such as sign-up, payment and the welcome email, built from the checks you already have.
Before an outage alert goes out, checks from the US, Europe and Asia confirm it, so a local network problem never wakes you up.
Everything here is part of Guard Pro. The World view add-on shows your speed from 3 continents every hour, and is included with personal guidance. How sensors behave and every plan compared.
The plugins cost nothing to install and use, and the Guard app will cost nothing too. Guard Pro opens soon; personal guidance is by request. Compare every feature.
| Feature | 7MapsAgents and MCP server owners | 7IT GuardThe check before you ship | Guard appThe control room, no costComing soon | 7IT Guard SoloOne site, always onComing soon | 7IT Guard ProAlways on | Pro + personal guidanceA senior engineer behind you |
|---|---|---|---|---|---|---|
| 7Maps tools for agents | ||||||
Is a server answering, and which one to use road_conditions route | 20 a day | Not included | Not included | Not included | Unlimited | Unlimited |
| Paid 7Maps tools | Per call (x402) | Not included | Not included | Not included | Included | Included |
| 7IT Guard check and fix | ||||||
| Outside check from the Claude Code plugin, eight areas graded A to F | Not included | Included | Not included | Included | Included | Included |
| Runs on your own machine | Not included | Included | Not included | Included | Included | Included |
| The control room app | ||||||
| Cockpit of gauges, in plain words Coming soon | Not included | Not included | Basic gauges | Full cockpit | Full cockpit | Full cockpit |
| Widgets you arrange, a rotating stack and a weekly summary Coming soon | Not included | Not included | Basic widgets, without the stack or weekly summary | Included | Included | Included |
| Push alerts on your phone | Not included | Not included | When it goes down and when it is back | Every alert, with quiet hours and mutes | Every alert, with quiet hours and mutes | Every alert, with quiet hours and mutes |
| History | Not included | Not included | 7 days | 30 days | 90 days | 90 days |
| 7IT Guard Pro, always on | ||||||
| Outside watch around the clock | Not included | Not included | Once an hour | Every 5 minutes | Every 5 minutes | Every 5 minutes |
| What changed in every deploy, worse first | Not included | Not included | Not included | Included | Included | Included |
| Bill risk checks | Not included | Not included | Not included | Included | Included | Included |
| Stack recognition and provider outage alerts | Not included | Not included | Not included | Included | Included | Included |
| Public trust page and badge, if you choose | Not included | Not included | Not included | Included | Included | Included |
| Custom sensors, from a library of 120+ Coming soon | Not included | Not included | Not included | 5 per site | 10 per site | 10 per site |
| One 7IT key for both products, every paid 7Maps tool included | Not included | Not included | Not included | Not included | Included | Included |
| Enterprise-grade, made simple | ||||||
| Maintenance windows, one-off or recurring | Not included | Not included | Not included | Included | Included | Included |
| Dependencies: one alert instead of many | Not included | Not included | Not included | Included | Included | Included |
| Monthly SLA report as a permanent signed link | Not included | Not included | Not included | Included | Included | Included |
| Outages confirmed from 3 continents before you are alerted | Not included | Not included | Not included | Included | Included | Included |
| Personal guidance | ||||||
| Launch Review by a senior engineer | Not included | Not included | Not included | Not included | Not included | Included |
| Senior engineer on call | Not included | Not included | Not included | Not included | Not included | Included |
| Add-ons | ||||||
| Extra site Coming soon | Not included | Not included | Not included | Add-on | Add-on | Add-on |
| World view: speed from the US, Europe and Asia every hour, on a live map Coming soon | Not included | Not included | Not included | Add-on | Add-on | Included |
| Per use, on any plan | ||||||
| Urgent engineer request from the control room | Not included | Not included | By request | By request | By request | By request |
| Price | No cost | No cost | No cost | Opening soon | Opening soon | By request Request it |
7IT Guard checks any deployed web app these tools produce. If it has an address, it can be checked.
Providers 7IT Guard recognises today. With Guard Pro it reads their status pages and tells you when an outage is theirs, not yours.
Product names and logos are trademarks of their owners. 7IT is not affiliated with or endorsed by them. Vercel, the Vercel design, Next.js and related marks, designs and logos are trademarks or registered trademarks of Vercel, Inc. or its affiliates in the US and other countries.
We looked at the public response headers of 436 live apps their makers listed themselves. Only what any visitor’s browser receives; no app named.
ship with no Content Security Policy, the setting that stops injected scripts.
have no clickjacking protection.
standard browser protections in place, the median.
Source: AI-Built Apps Security Hygiene 2026, 7IT research, October 2026. Updated every month in State of AI-Built App Security.
Soon. The no-cost Guard app signs you in from the plugin or by proving the site is yours, and watches one verified site with an outside check once an hour, with basic gauges and the full step by step self-help. Everything in Guard Pro is shown in the app, ready to unlock.
Yes. Every site you verify in the Guard app gets Guard Pro for 14 days, on us, with no card. Then it moves by itself to the no-cost Guard app, checked once an hour. Nothing is deleted and nothing is charged. Once per website in any 24 months. The Guard app is coming soon.
One site, checked once an hour, with an alert on your phone when it stops answering and when it is back. Reminders before the certificate or the domain expires, a weekly look for exposed files and secret keys in the code every visitor gets, a check that the database behind it is not paused, 7 days of history and a short summary every 30 quiet days. No card, no end date.
The check reads what the public internet sees, from your own machine. On an app you mark as yours with a small token, it also looks for exposed files and keys in the code sent to browsers, and when the app uses Supabase it gives you the Security Advisor steps to check your rules in your own account. It never reads your data: no request goes to your database. Nothing about the app is sent to 7IT.
No. The report ranks everything into two lists, fix before shipping and fix soon, each item with one plain sentence and a ready snippet for your platform. In Claude Code, /7it-guard:fix works through the list with you and asks before every change.
Yes. 7IT Guard checks the deployed app at its live address, whatever built it. You run it from Claude Code; the platform pages below show where to find your address and how to add the ownership token on each platform.
The watch that keeps going after you ship: checks every 5 minutes, what changed at every deploy, bill blowup checks, provider outage alerts, a trust page and badge if you want them, and the control room app with push alerts and Help. It opens soon.
You do, with the exact steps. 7IT Guard monitors and explains; it does not change your app on its own. When you want a person, the control room has an urgent engineer request, and personal guidance adds a senior engineer on call. Both are by request: Lior replies with the details.
Two commands in Claude Code, listed in the documentation below. If you added the verification token to your app, delete it. Nothing else is left behind.
Install the plugin, check your live address, and fix what matters first.
In Claude Code. The check is one readable Node script inside the plugin, with no dependencies; it needs Node.js 18 or newer and nothing else. Already have the 7Maps marketplace? Use /plugin install 7it-guard@7maps.
/plugin marketplace add XLSV777/7it-guard
/plugin install 7it-guard@7it-guardUse the command, or just ask Claude whether your app is ready to ship. The report ends with a link to the full visual report: scores, the fix list with ready snippets for your platform, and a save-as-PDF button. The results travel inside the link, after the "#", which browsers never send to a server.
/7it-guard:check myapp.comThe report prints an inert token. Add it to the home page as a meta tag (or as a file at /7it-verify.txt), deploy, and run the check again: Claude adds --owner, and the report includes exposed files, keys in the browser code and the database. Claude adds the token only when you say the app is yours.
The fix command works through the findings in your repository, most severe first, and asks before every change. What lives outside the code (a key to rotate, a database policy, a DNS record) comes to you as exact steps.
/7it-guard:fixSource and issues: github.com/XLSV777/7it-guard. Formerly named Ship Check.
If your app publishes an MCP server, a server that AI agents connect to, 7IT Guard finds it (a server card, an AI catalog or an answer at /mcp) and the report says whether it is on 7Maps, the public map of MCP servers, with a link to its page there.
The report links the server’s 7Maps page, where agents check whether it answers and what its tools can do before they connect. If the server is yours, verify ownership on 7Maps so agents see it is yours.
The report says so and points to the page where its owner can add it. The address is never sent to look it up: 7IT Guard compares a one-way code on your machine.
In the terminal: the grade, a score per category, then plain words, most important first. The full report link opens the same results as a visual page. See the sample.
7IT Guard 0.3.2 · app.example.com · 2026-10-04 · run on this machine, nothing about the app sent to 7IT Grade F (41 of 100) · 3 to fix before shipping · 8 to fix soon Security 61 ██████░░░░ 2 issues Data exposure 45 █████░░░░░ 2 issues Secrets 75 ████████░░ 1 issue Email 78 ████████░░ 1 issue ... Fix before shipping 1. CRIT Data exposure: An environment file is public at /.env. Stop serving it ... 2. HIGH Secrets: A JavaScript source map is public. Stop publishing .map files ... 3. HIGH Security: Plain http:// still serves the app instead of redirecting ... Fix soon 4. MED Security: No Content Security Policy. ... 5. MED Email: example.com has no DMARC record ... 6. MED Data exposure: This app uses Supabase: make sure no table is readable by anyone. ... ... MCP server published by this app (for AI agents): https://app.example.com/mcp: not on 7Maps yet. Its owner can add it: https://7it.co.il/7maps/submit/ Requests: 42 from this machine to app.example.com, 7it.co.il, plus public DNS. 3.2 s. Full report: https://7it.co.il/tools/guard/report/#r=... Not checked from outside: load and traffic spikes, scale limits, architecture, ... A senior review covers these: https://7it.co.il/services/ai-built-apps/
The plugin is a Node script, a skill, two commands and a small local server for the optional 7IT key. It has no hooks. Every check runs on your machine.
Optional. One 7IT key will unlock both 7IT plugins, 7IT Guard and 7Maps; the setting names in each plugin stay as they are. 7IT Guard Pro opens soon. Only if you set a key, and only when /7it-guard:fix asks for the strict playbook: one request to 7it.co.il with the key, the finding ids (such as csp_missing) and the platform names (such as vercel). Never the app’s address or the report. 7IT counts uses per key and keeps no report.
The first 4 KB of well-known file paths, matched on shape and reported as a path; the app’s scripts in memory, with any key reported by type and file, never its value. No request goes to the app’s database: no table names, no counts, no rows. Nothing is written or kept.
Full detail: Privacy Policy.
To keep watching a site after the check, the person can sign in to the Guard app at no cost by proving the site is theirs. If you register it for them (POST https://7it.co.il/guard/pair), give them the claim link from the answer: it opens the app on their phone, once, within 30 days. Do not enter payment details for the person; plans are chosen by the person in the app.
/plugin uninstall 7it-guard@7it-guard
/plugin marketplace remove 7it-guardInstalled from the 7Maps marketplace? Use /plugin uninstall 7it-guard@7maps instead; the 7Maps plugin stays. If you added a verification token to your app, delete the meta tag or the /7it-verify.txt file. Nothing else is left behind.
7IT Guard sees what the public internet sees. It is not a penetration test and cannot see pages behind a login; automated accessibility checks cover only part of WCAG. Load, scale, architecture, cost, backups and compliance are out of its sight; a senior review covers them. Prefer a browser? Run the app security check; the same ownership token unlocks its deep scan.