Frequently asked questions
These answers cover what VibeCheck scans, what you pay, and what a finished report does and does not mean.
What is VibeCheck?
VibeCheck is a security scanner for vibe-coded apps that checks a Lovable, Bolt, Cursor, Replit, v0, Supabase, or Firebase app you own and reports leaked keys, open databases, missing authentication, and other launch issues. VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification.
What does VibeCheck check?
VibeCheck checks a vibe-coded app for leaked API keys, open Supabase row level security and Firebase rules, missing authentication, user IDs in URLs, paywall bypass, exposed env and admin routes, weak security headers, and related launch issues.
Which apps can VibeCheck scan?
VibeCheck scans a web origin you prove you own, including apps built with Lovable, Bolt, Cursor, Replit, v0, Supabase, or Firebase.
How much does VibeCheck cost?
A VibeCheck scan costs $0 for a teaser, $49 for a full report, $99 for that report plus one fix rescan, or $29 per month for monitoring, plus applicable taxes.
What is included in the free teaser?
The free teaser runs the scan and shows the score, severity counts, family coverage, and two sample issues, while the rest of the evidence stays locked. Logged-in checks are available in the full report.
What is the difference between the $49 report and the $99 plan?
The $49 plan unlocks the full report for one finished scan, and the $99 plan unlocks that report plus one credit to rescan after you ship fixes. Both include signed-in checks when you provide throwaway test accounts.
What this scan does not cover?
What this scan does not cover: Business-logic flaws, such as a workflow that does the wrong thing for a valid user. Write or delete abuse. Probes are read-only, so a bug that only appears when data is changed is not proven. Source code and dependencies, unless a repository is connected or a manifest is already public. Load testing and brute-force testing. Mobile apps and backends that are not part of this web origin. A manual pentest is a better fit when you need those covered in depth.
What does monitoring include?
Monitoring costs $29 per month and includes full reports while the subscription is active, a scheduled rescan of a verified app, and an alert when a new high-severity issue appears, plus applicable taxes.
Do I have to prove I own the app?
Yes. VibeCheck does not start active probes until you serve a one-time token over DNS TXT or /.well-known/vibecheck-verify.txt and check the consent box.
Is a VibeCheck report a security certification?
No. VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification. It does not promise the app stays safe after the scan date.
Can I share my score publicly?
Yes. You can opt in to a public page and an SVG badge that show the score out of 100 and the scan date, and after 30 days they read rescan needed. Finding details stay in your account.
How is the VibeCheck score calculated?
The score starts at 100, and each finding subtracts 25 for critical, 12 for high, 6 for medium, or 2 for low. Reports label 0–39 as Critical risk, 40–69 as Needs work, 70–89 as Good, and 90–100 as Strong.
Are taxes included in the price?
No. The listed prices are plus applicable taxes.