Secrets & leaked credentials
Private keys and service credentials that shipped in public bundles or files.
Launch scan for vibe-coded apps
Ship the vibe. Check the doors.
VibeCheck is a security scanner for vibe-coded apps that checks a Lovable, Bolt, Cursor, Replit, v0, Supabase, or Firebase app you own and reports leaked keys, open databases, missing authentication, and other launch issues.
VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification.
What does VibeCheck check?
VibeCheck checks a vibe-coded app for leaked API keys, open Supabase row level security and Firebase rules, missing authentication, user IDs in URLs, paywall bypass, exposed env and admin routes, weak security headers, and related launch issues.
Leaked API keys
VibeCheck looks for private credentials in downloaded JavaScript and on public paths, including service-role keys and secrets placed in NEXT_PUBLIC_ or VITE_ variables.
Supabase row level security
VibeCheck checks whether a table or realtime channel can be read or written with the public anon key that the app already ships to the browser.
Firebase security rules
VibeCheck checks whether the Firebase project returns data to a request that has no signed-in user.
Missing authentication
VibeCheck requests admin pages and APIs without a session to see whether they return privileged data.
User IDs in URLs
VibeCheck checks whether substituting another sequential id on a read-only request returns someone else's record.
Paywall bypass
VibeCheck checks whether a premium feature is enforced only in the browser, or a payment webhook accepts a body with no signature.
Exposed env files
VibeCheck requests paths such as .env, .git metadata, and source maps that should never be on a public host.
Security headers, CORS, and cookies
VibeCheck checks HTTPS, Content-Security-Policy, HSTS, cookie flags, and CORS that allows any origin with credentials.
Open storage buckets
VibeCheck checks whether a storage bucket or upload folder can be listed without a signed-in user.
Open AI routes
VibeCheck checks whether a model route answers without authentication, has no rate limit, or returns a system prompt.
The ten issues we put first
These are the headline findings. The full scan still covers every family below. The free teaser shows severity counts and two of the highest-priority issues.
- 1
Open Supabase or Firebase data
Tables or realtime data readable or writable with the public client key.
- 2
Secrets in the client or a public env file
Service-role keys, provider secret keys, and NEXT_PUBLIC_ / VITE_ leaks.
- 3
Admin without server-side auth
Admin pages, APIs, or tables that answer with no session.
- 4
Guessable object ids
Sequential ids that return another user's data to a read-only request.
- 5
Public storage buckets
Buckets or upload folders that can be listed.
- 6
Browser paywalls and unsigned webhooks
Premium flags checked only in the client, or a payment webhook with no signature check.
- 7
Open AI endpoints
Model routes with no auth, no rate limit, or a system-prompt leak.
- 8
Exposed project files
.env, .git, source maps, and debug or test routes.
- 9
Weak auth configuration
Client-side admin roles, unlimited login attempts, and open redirects.
- 10
Headers, CORS, cookies, and verbose errors
Wildcard CORS with credentials, missing CSP or HSTS, insecure cookies, stack traces.
Eight families, one coverage summary
Cloud backends & storage
Supabase, Firebase, and buckets left open to the public client.
Access control
Admin surfaces, object ids, and features enforced only in the browser.
Injection & XSS
Untrusted input that comes back as HTML, plus prompt leakage from AI routes.
Authentication & session
Signup, login, callbacks, and webhook authenticity.
Transport & headers
HTTPS, browser security headers, CORS, and cookie flags.
Information disclosure
Env files, git metadata, source maps, debug routes, and stack traces.
Dependencies
Publicly exposed manifests that pin a library to a known-vulnerable version.
How much does VibeCheck cost?
A VibeCheck scan costs $0 for a teaser, $49 for a full report, $99 for that report plus one fix rescan, or $29 per month for monitoring, plus applicable taxes.
Free teaser
$0
Run a scan and see severity counts plus two sample issues. The rest of the report stays locked. Logged-in checks are available in the full report.
Full report
$49
plus applicable taxes
Unlock the full report for one scan: every finding, evidence, copy-paste fixes, and signed-in checks with throwaway test accounts.
Report + rescan
$99
plus applicable taxes
Full report on this scan, including signed-in checks with throwaway test accounts, plus one credit to rescan after you ship fixes.
Continuous monitoring
$29/mo
plus applicable taxes
Scheduled rescans of a verified app and an alert when a new high-severity issue shows up.
plus applicable taxes
Pricing detailsFree mini check
Start with security headers and common public files on an origin you own. It is a funnel into the full launch scan, and the report says which families did not run.
Start a mini checkScore you can show
Opt in to a public page and an SVG badge. Visitors see the score and the scan date. After 30 days the badge reads “rescan needed”. Finding details never leave your account.