What’s in the alert
- Subject: for example “[Heedza] Checkout broken on your-app.lovable.app”.
- What happened: one sentence, for example “The payment page opened, but the ‘Subscribe’ button was missing.”
- The app and its address.
- A button that opens the check in your dashboard.
- The fix to paste into your AI tool, ready to copy.
- A picture of the page that failed, attached to the email.
- On Pro and Business, with GitHub connected: for some problems, a Fix it for me button at the top, with Or fix it yourself and the prompt below it. See how Fix it for me works.
You get one alert per failure. While the same check is still failing, Heedza doesn’t send it again.
Where alerts go
- Email alerts: every plan
- Slack, Telegram and webhook alerts: paid plans
How the fix works
When you add an app, you pick the tool you made it with. The fix is written for the tool you pick: Lovable, ChatGPT (including Codex), Claude, Cursor, Bolt, Replit, v0, GitHub Copilot, Gemini, Windsurf or Base44 (11 tools), or any other AI tool. For Lovable, Bolt, Replit, v0 and Base44, it also includes steps for that tool’s settings.
Each fix says which page failed, what was missing, and asks the tool to make a small change without redesigning the page. Fixes for payment pages tell the tool not to enter a card or make a charge.
You paste the prompt into your tool, check the change, and publish. Or, on Pro and Business, for some problems you press Fix it for me and approve the fix Heedza opens on GitHub. Heedza doesn’t change your app unless you approve a fix.
Example fix (for Lovable)
You are editing this Lovable project. Change only what is required to fix the failure below. Do not redesign the page.
Heedza found that the payment page on https://your-app.lovable.app is broken.
What happened: The payment page opened, but the “Subscribe” button was missing.
What to do:
- Restore the checkout page so a visitor can see the payment form. Keep the pay button from charging anything during a test.
- Keep the existing URL if you can, so the saved check still finds it.
- The check stops before payment. Do not submit a card, do not click Pay, and do not create a charge while you verify the fix.
After the change, load the page in a browser and confirm the failure above is gone.Security watch alerts
Every time we check your site, we look at it from the outside, like a visitor, and tell you in plain words when something is exposed or changes. Every alert comes with the exact fix to paste into your AI tool.
- A new outside script on your homepage. The alert has two buttons: It was me (the address joins your known list and we stop asking about it) and Get a fix prompt (a ready-made prompt for your AI tool, to find and remove it).
- An exposed file, an unexpected redirect, or a dropped security setting. Each alert has a fix prompt, written for the AI tool you chose.
- Google’s list flags your site as potentially unsafe. Shown only to you, in your dashboard and alert. It says what Google says, links to Google’s advisory and has a fix prompt. We do not find this ourselves.
Fixes
On Pro and Business, with GitHub connected, some alerts have a Fix it for me button. Nothing starts until you press it. Heedza then opens the fix on GitHub, and nothing changes until you approve it. It works only for some problems: a page Heedza checks that stopped working, a file that should not be public, and a security setting your site stopped sending. For other problems, and on other plans, the fix prompt is a prompt you paste into your AI tool. Your AI tool makes the change, and you should check it before you publish. How Fix it for me works.
Security watch · Example
New outside script on your site (cdn-unknown-example.com)
A new outside script started loading on your homepage from cdn-unknown-example.com. If you or your builder added it (for example a chat widget or analytics), choose “It was me” in Heedza. If you did not add it, ask your builder or host where it comes from.
Fix to paste into Lovable
You are editing this Lovable project. Change only what is required to fix the problem below. Do not redesign the page. Heedza looked at the homepage of https://your-app.lovable.app and saw a script loading from an address it had not seen before: cdn-unknown-example.com (a script). What to do: 1. Search the project for “cdn-unknown-example.com”, in the HTML, layout files, tag manager settings and installed plugins or packages. 2. Tell me what added it and when, and what it does. …
We check from the outside. We cannot see inside your server, so we cannot tell if its software is up to date or if someone left hidden files that are not public.
What it doesn’t do
- The prompt is written from what Heedza saw on the live page. Heedza only sees your code if you connect GitHub to get fixes. You pick which repositories.
- Alerts are sent by email on every plan, and to Slack, Telegram or a webhook on paid plans. On paid plans, Telegram alerts include the full report and the fix prompt in the chat, so you can read them without logging in.