Free security scan for apps built with Lovable, Bolt, Cursor, v0 or Claude Code. Every finding comes in plain English with a fix prompt you paste straight back into your AI tool.
Files are read in your browser, scanned in memory, and never stored. Prefer fully offline? Use the CLI.
No code needed. Checks your deployed site for an exposed .env, published source maps,
missing security headers, open CORS and robots.txt leaks.
Anthropic, OpenAI, Stripe (live vs test), AWS, Google, GitHub, Slack, Telegram, private keys, database URLs with passwords. Secrets in browser code are escalated — every visitor has them.
Hardcoded JWTs are decoded: a service_role key (bypasses all Row Level Security) is critical; an anon key becomes a reminder to verify RLS.
dangerouslyAllowBrowser, LLM APIs called from the frontend, secrets in VITE_/NEXT_PUBLIC_ variables, .env not gitignored.
SQL built by string interpolation, shell injection, XSS via innerHTML, eval, CORS open to every origin, debug mode left on.
Publicly readable .env or .git, published source maps that rebuild your source, missing security headers, plain HTTP, and robots.txt that signposts your admin pages.
Every finding ends with a prompt written for your AI tool — paste it into Cursor, Claude Code, Lovable or Bolt and let it do the fix.
Everything worth checking before you launch, in the order worth fixing it. Works whatever built your app.
Row Level Security, the service_role key, and the other four things Lovable apps most often get wrong.
Why the preview makes secrets feel private, what the VITE_ prefix really does, and where your keys go after deploy.
The invisible server/client boundary in Next.js, and why every Server Action is a public endpoint.
Rotate first, investigate second. The steps in order, provider by provider, for when it's already happened.
Agents read your whole repo and run commands. Secrets in context, prompt injection, and why auto-accept is the safety mechanism.
Your config isn't a leak — which is exactly why Security Rules carry all the weight. Test mode, ownership checks, and Storage.
It bypasses every RLS policy you have. Tell it apart from the harmless anon key, rotate without logging out your users, and check what was reachable.
The one that can move money, not just read it. Live vs test keys, rolling without dropping payments, and reading the audit log.
A bill, not a breach — revoking is free. The part that matters is why the browser had the key in the first place.
The same scanner, fully offline, zero dependencies (Python 3.9+). Drop it into CI — it exits 1 on high/critical findings.
python3 -m vibecheck /path/to/your/app --markdown report.md python3 -m vibecheck --url https://myapp.com