Is your vibe-coded app safe?
Paste your app's address. In about a minute we check for leaked API keys, exposed Supabase keys, public .env files and missing security headers. Built for apps made with Lovable, Bolt, v0, Replit and Cursor.
Read-only and safe: we only look at what any visitor's browser already downloads. Only scan apps you own or have permission to test.
0/100
What we found
Get every fix
The full report explains each problem in plain English and gives you a copy-paste prompt to fix it in Lovable, Bolt, Cursor or Claude Code.
Full reports are coming soon.
What we check
Leaked secrets
OpenAI, Anthropic, Stripe, AWS, GitHub and Supabase service keys hiding in your JavaScript.
Supabase setup
Whether you use Supabase, and whether a key that bypasses every security rule has been shipped to the browser.
Exposed files
Public .env files, .git folders and source maps that give away your code.
Security headers
The browser protections most AI-built apps are missing, with the exact lines to add.