Your AI-built app has holes. Find them first.
Lovable, Bolt, v0 and Cursor ship working apps in an afternoon. They also ship exposed API keys, open database rules and published source code. VibeCheck finds all of it from a public URL, and tells you exactly what to change.
No login, no probing, nothing your app doesn't already hand to every visitor.
One urgent, three to close
33 checks runfound: service_role key eyJhbGciOi…
Thirty-three checks, in eight groups.
Every one runs on what your app already serves to anyone who opens it. No login, no probing, no traffic you did not already invite.
-
Transport and TLS
HTTPS, certificates, HSTS, and whether plain HTTP actually redirects.
-
Security headers
CSP, clickjacking, nosniff, referrer policy and permissions policy.
-
Cookies
HttpOnly, Secure and SameSite on the cookies that hold your sessions.
-
Information disclosure
Server versions, source maps, robots.txt, database errors, secrets in comments.
-
Secrets in front-end code
Full-access keys shipped to the browser, and public keys that still need locking down.
-
Outdated libraries
JavaScript dependencies with publicly documented vulnerabilities.
-
Web hygiene
CORS, CSRF, DOM XSS sinks, mixed content and script integrity.
-
Firebase and Supabase
Security Rules and Row Level Security, where your data actually lives.
It works. That is not the same as it being safe.
AI builders optimise for shipping, not for hardening. Keys end up in the browser bundle, database rules stay open, source maps go out with the build. Nothing looks broken, so nobody looks.
What is already exposed?
Secret keys in your bundle, published source maps, server versions, database errors. Things anyone can download from your app today.
What is left wide open?
Firebase and Supabase rules, CORS, CSRF, clickjacking, missing headers. The locks your builder never set, checked without touching anything.
What do you fix first?
Findings are ordered by how much damage they allow, each with one line on the risk and the exact header, file or rule to change.
Paste a URL, read the findings.
- 01
Paste your app's URL
Anything you can open in a browser. VibeCheck loads it exactly the way a visitor does.
- 02
Watch all 33 checks run
Transport, headers, cookies, secrets, libraries and database rules. A progress bar names each stage as it goes.
- 03
Fix the list, top to bottom
A letter from A to F, the urgent findings first, and the exact header, file or rule behind every one.
One URL in. A fix list out.
The whole thing takes about twenty seconds. Here is every screen you will see.
Any URL you can open in a browser.
No login. No probing. One ordinary request.
- Transport and TLS
- Security headers
- Cookies
- Secrets in front-end code
- Firebase and Supabase rules
- Secret key exposed in your bundle Urgent
- Supabase detected, no Row Level Security Warning
- Source maps published Warning
- HTTPS and HSTS are on Passed
Every finding opens to the risk, the fix and the raw evidence.
- Paste the URL
- 33 checks run
- Read the report
Honest about what it can see, and what it can't.
The two findings that actually cost you money.
A full-access key shipped to the browser, or a database rule left open. These are the mistakes AI builders make most, and the only two that let a stranger read your data or spend from your account.
- Service-role and secret keys found in front-end code
- Firebase rules that still read allow read, write: if true
- Supabase tables with no Row Level Security behind them
- Keys that are meant to be public, told apart from the ones that aren't
Revoke and rotate it now, then move it to a server environment variable.
service_role "eyJhbGciOi…"
match /{document=**} → read, write: if true
# suggested
match /users/{uid} → if request.auth.uid == uid
Every finding says what, why, and what to do.
No alarm bells and no jargon. A missing rule is information, written the way a colleague would explain it, with the exact line to change.
- One line on the risk, in plain words
- The exact header, file or rule to change
- The raw evidence, so you can verify it yourself
- The likely builder, so you know which mistakes to expect
A grade you can read at a glance. Evidence you can check.
Every report opens with one letter and the urgent findings first. Under each sits the risk, the exact fix, and the raw header, file or rule it came from.
Share report
Send the findings straight to whoever can fix them, evidence attached.
Download PDF
Keep a copy for a client, a teammate or your own records.
Scan history
Fix something, scan again, and watch the grade actually move.
All 33 checks are passive and run on public signals. A clean report means these checks found nothing, not that your app is secure. It is evidence, not proof.
Before you scan.
Short answers on what VibeCheck finds, and what it deliberately doesn't.
Is this a penetration test?
No. All 33 checks are passive: VibeCheck requests your app the way any visitor would and reads what comes back. It never logs in, never submits forms, never probes for weaknesses. Results are evidence, not proof.
Does it work on Lovable, Bolt, v0 or Cursor apps?
That is exactly what it is for. Those builders ship working apps fast, and each one leaves its own predictable gaps: keys bundled into the front end, database rules left open, source maps published with the build. VibeCheck knows what to look for.
It says my API key is exposed. Is that actually bad?
It depends which key, and VibeCheck tells you which. A Supabase anon key or a Firebase API key is meant to be public, so the report points you at your access rules instead. A service-role or secret key is a different matter: revoke it, rotate it, and move it to a server environment variable today.
What does the grade mean?
A and B mean the checks mostly pass. C and D mean there are real gaps worth closing. F means something is open right now that lets a stranger read your data, run code on your pages, or spend your money. Every grade comes with the findings behind it.
What if it finds nothing?
The report says so plainly. That means these 33 checks found nothing, which is not the same as your app being secure: VibeCheck sees what your app broadcasts, not your server, your backend logic, or your business rules.
Can I share a report?
Yes. Share the link or download it as a PDF, so whoever actually builds the app gets the risk, the fix and the evidence in one place. Every report carries the same note about passive checks and public signals.
Can I scan an app I do not own?
VibeCheck makes one ordinary request, the same one your browser makes when you visit. It is the lightest possible footprint, but it is still a request against someone else’s app, so use judgement.
Find out what your app is handing out.
Paste a URL. Thirty-three passive checks, a graded report, and the exact fix for every finding.