Vibe-coder stack / Launch scan
Is your vibe-coded app safe to launch?
You built it with Lovable, Bolt, Cursor or Claude Code. Before you share the link, run one scan: leaked keys, exposed files, security headers, Google basics, email setup and AI readiness. Every problem comes with a fix prompt you paste back into your AI builder. Free.
What one scan checks
Leaked keysOpenAI, Anthropic, Stripe secret, AWS, GitHub and other keys inside your JavaScript bundles, plus the Supabase service_role key that unlocks your whole database.
Exposed filesWhether
/.env, /.env.local or /.git/config can be downloaded by anyone.Security headersHTTPS redirect, HSTS, clickjacking protection, Content-Security-Policy and small hardening headers.
Google and link previewsTitle, description, share image, H1, blank-page-without-JavaScript, soft 404s, sitemap and noindex.
Email and domainSPF, DMARC and DKIM, so your email reaches the inbox and nobody can pretend to be you, plus your domain's expiry date.
AI assistantsWhether ChatGPT, Claude and Perplexity can find and read your site (the full agent-readiness check).
Why AI-built apps leak
AI builders write working code fast, and they put whatever makes it work into the browser. A Stripe secret key or an OpenAI key in the frontend works fine in testing, and anyone can copy it from your JavaScript. Supabase apps send their anon key to the browser on purpose, so the only thing protecting your data is Row Level Security on every table. The service_role key skips those rules entirely, so it must never be in frontend code.
Questions
- Is this a hacking tool?
- No. It reads only public files that any browser can load: your pages, your JavaScript and a few well-known paths like
/.env. It never logs in, never tries passwords and never writes anything. Please scan sites you own or have permission to test. - Do you store the results?
- The report is kept for one hour so the share link works, then deleted. Keys are always shown masked, and we never store the contents of an exposed .env file, only the variable names.
- Can it check my Supabase Row Level Security?
- Not from outside without proof that you own the app, so it tells you when you're using Supabase from the browser and gives you a prompt to check RLS yourself. A deeper scan that tests your database (after you verify ownership) is coming.
- Can I get this every week?
- Yes. Sign in and add your site: we run this scan every week and show you what changed (new leaks, fixed problems, your score). It costs $1.25 a week from your credit, about $5 a month, and you can stop any time.
- Can my agent run it?
- The pieces are already tools on one free key: secrets detector, domain intel and the agent-readiness check. See the whole vibe-coder stack.