Paste your app's URL. In about 20 seconds you'll see what's visible from the outside - leaked keys, email setup, security headers, mobile basics. No signup.
This checks only what any visitor's browser can already see. It never logs in and never touches your data.