# VibeCheck

> VibeCheck is a security scanner for vibe-coded apps that checks a Lovable, Bolt, Cursor, Replit, v0, Supabase, or Firebase app you own and reports leaked keys, open databases, missing authentication, and other launch issues.

VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification.

## Pricing

A VibeCheck scan costs $0 for a teaser, $49 for a full report, $99 for that report plus one fix rescan, or $29 per month for monitoring, plus applicable taxes.

- Free teaser ($0): Run a scan and see severity counts plus two sample issues. The rest of the report stays locked. Logged-in checks are available in the full report.
- Full report ($49 one-time, plus applicable taxes): Unlock the full report for one scan: every finding, evidence, copy-paste fixes, and signed-in checks with throwaway test accounts.
- Report + rescan ($99 one-time, plus applicable taxes): Full report on this scan, including signed-in checks with throwaway test accounts, plus one credit to rescan after you ship fixes.
- Continuous monitoring ($29 per month, plus applicable taxes): Scheduled rescans of a verified app and an alert when a new high-severity issue shows up.

plus applicable taxes

## What VibeCheck checks

VibeCheck checks a vibe-coded app for leaked API keys, open Supabase row level security and Firebase rules, missing authentication, user IDs in URLs, paywall bypass, exposed env and admin routes, weak security headers, and related launch issues.

- Leaked API keys: VibeCheck looks for private credentials in downloaded JavaScript and on public paths, including service-role keys and secrets placed in NEXT_PUBLIC_ or VITE_ variables.
- Supabase row level security: VibeCheck checks whether a table or realtime channel can be read or written with the public anon key that the app already ships to the browser.
- Firebase security rules: VibeCheck checks whether the Firebase project returns data to a request that has no signed-in user.
- Missing authentication: VibeCheck requests admin pages and APIs without a session to see whether they return privileged data.
- User IDs in URLs: VibeCheck checks whether substituting another sequential id on a read-only request returns someone else's record.
- Paywall bypass: VibeCheck checks whether a premium feature is enforced only in the browser, or a payment webhook accepts a body with no signature.
- Exposed env files: VibeCheck requests paths such as .env, .git metadata, and source maps that should never be on a public host.
- Security headers, CORS, and cookies: VibeCheck checks HTTPS, Content-Security-Policy, HSTS, cookie flags, and CORS that allows any origin with credentials.
- Open storage buckets: VibeCheck checks whether a storage bucket or upload folder can be listed without a signed-in user.
- Open AI routes: VibeCheck checks whether a model route answers without authentication, has no rate limit, or returns a system prompt.

## Key pages

- [Ship the vibe. Check the doors.](https://vibecheck.textmatchstudio.com): Product overview and the one-sentence definition.
- [How much does VibeCheck cost?](https://vibecheck.textmatchstudio.com/pricing): Free teaser, full report, rescan, and monitoring.
- [Frequently asked questions](https://vibecheck.textmatchstudio.com/faq): Short questions and direct answers.
- [How does a VibeCheck scan work?](https://vibecheck.textmatchstudio.com/how-it-works): Ownership proof, consent, and what the scan requests.
- [What should I read before a VibeCheck scan?](https://vibecheck.textmatchstudio.com/guides): Index of the security guides.
- [Is my Lovable app secure?](https://vibecheck.textmatchstudio.com/guides/is-my-lovable-app-secure): What to verify on a Lovable app before launch.
- [Is row level security on for my Supabase tables?](https://vibecheck.textmatchstudio.com/guides/supabase-rls-checklist): Supabase row level security checklist.
- [Did my vibe-coded app leak an API key?](https://vibecheck.textmatchstudio.com/guides/leaked-api-keys-vibe-coding): How a vibe-coded app leaks an API key and what to do.
- [What does a VibeCheck report look like?](https://vibecheck.textmatchstudio.com/demo-report): Sample report UI with invented data, not a live scan.
- [Terms of service](https://vibecheck.textmatchstudio.com/terms): Draft terms. Not final.
- [Privacy](https://vibecheck.textmatchstudio.com/privacy): Draft privacy notes. Not final.
- [What is the VibeCheck refund policy?](https://vibecheck.textmatchstudio.com/refund): Draft refund policy. Not final.
- [What is the VibeCheck scanner?](https://vibecheck.textmatchstudio.com/scanner-info): How a scan identifies itself, and how to report abuse.
- [How do I contact VibeCheck?](https://vibecheck.textmatchstudio.com/contact): Placeholder contact email and the abuse mailbox.
- [llms-full.txt](https://vibecheck.textmatchstudio.com/llms-full.txt): longer product, pricing, FAQ, and guide text for language models.

## FAQ

### What is VibeCheck?

VibeCheck is a security scanner for vibe-coded apps that checks a Lovable, Bolt, Cursor, Replit, v0, Supabase, or Firebase app you own and reports leaked keys, open databases, missing authentication, and other launch issues. VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification.

### What does VibeCheck check?

VibeCheck checks a vibe-coded app for leaked API keys, open Supabase row level security and Firebase rules, missing authentication, user IDs in URLs, paywall bypass, exposed env and admin routes, weak security headers, and related launch issues.

### Which apps can VibeCheck scan?

VibeCheck scans a web origin you prove you own, including apps built with Lovable, Bolt, Cursor, Replit, v0, Supabase, or Firebase.

### How much does VibeCheck cost?

A VibeCheck scan costs $0 for a teaser, $49 for a full report, $99 for that report plus one fix rescan, or $29 per month for monitoring, plus applicable taxes.

### What is included in the free teaser?

The free teaser runs the scan and shows the score, severity counts, family coverage, and two sample issues, while the rest of the evidence stays locked. Logged-in checks are available in the full report.

### What is the difference between the $49 report and the $99 plan?

The $49 plan unlocks the full report for one finished scan, and the $99 plan unlocks that report plus one credit to rescan after you ship fixes. Both include signed-in checks when you provide throwaway test accounts.

### What this scan does not cover?

What this scan does not cover: Business-logic flaws, such as a workflow that does the wrong thing for a valid user. Write or delete abuse. Probes are read-only, so a bug that only appears when data is changed is not proven. Source code and dependencies, unless a repository is connected or a manifest is already public. Load testing and brute-force testing. Mobile apps and backends that are not part of this web origin. A manual pentest is a better fit when you need those covered in depth.

### What does monitoring include?

Monitoring costs $29 per month and includes full reports while the subscription is active, a scheduled rescan of a verified app, and an alert when a new high-severity issue appears, plus applicable taxes.

### Do I have to prove I own the app?

Yes. VibeCheck does not start active probes until you serve a one-time token over DNS TXT or /.well-known/vibecheck-verify.txt and check the consent box.

### Is a VibeCheck report a security certification?

No. VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification. It does not promise the app stays safe after the scan date.

### Can I share my score publicly?

Yes. You can opt in to a public page and an SVG badge that show the score out of 100 and the scan date, and after 30 days they read rescan needed. Finding details stay in your account.

### How is the VibeCheck score calculated?

The score starts at 100, and each finding subtracts 25 for critical, 12 for high, 6 for medium, or 2 for low. Reports label 0–39 as Critical risk, 40–69 as Needs work, 70–89 as Good, and 90–100 as Strong.

### Are taxes included in the price?

No. The listed prices are plus applicable taxes.

## How a scan works

### 1. How do I prove I own the origin?

Publish the one-time token as a DNS TXT record on the hostname, or on _vibecheck, or as the entire body of /.well-known/vibecheck-verify.txt on that origin.

### 2. What consent does VibeCheck require?

Check the consent box in the scan form. Active probes do not start until both the ownership proof and the consent box are present.

### 3. What does the scan actually request?

VibeCheck requests pages and public files, and it may send a few tiny unauthenticated POST requests to see whether a login, webhook, or AI route rejects bad input. It does not send PUT, PATCH, or DELETE. A paid full report can also sign in with up to two throwaway test accounts and then send only GET and HEAD, plus that login request.

### 4. What do I see when the scan finishes?

A finished scan shows a score out of 100, family-by-family coverage, severity counts, and two sample issues. The rest of the evidence stays locked on the free teaser.

### 5. How do I unlock the full report?

The $49 plan unlocks every finding on that scan, with location, redacted evidence, and a copy-paste fix. The $99 plan adds one credit to rescan after you ship fixes. $29 per month monitoring schedules rescans and alerts you when a new high-severity issue appears. Listed prices are plus applicable taxes.

### What will the worker refuse to do?

The worker does not send PUT, PATCH, or DELETE, and it refuses link-local and metadata addresses. It does not start probes until the ownership file or DNS TXT record is in place and the consent box is checked.

## Guides

### Is my Lovable app secure?

A Lovable app is secure only when the database rules, server-side auth, and client bundle match what the UI shows; a working preview does not check those.

#### What should I verify before launch?

Verify data access, secrets in the client, admin routes, and paywalls on the origin you own before you treat a Lovable preview as ready.
VibeCheck can run that review after you publish a DNS TXT record or a well-known file and check the consent box.

#### Can the public Supabase key read my tables?

The anon key in the browser is public by design, so a table with row level security off, or a policy that allows the anon role, is readable by anyone who loads the app.
Turn on row level security and add a policy that limits rows to the signed-in user before you ship.

#### What if the app uses Firebase?

Firebase client config is public, and the project returns data to strangers when the rules allow a read with no signed-in user.
Start from deny-all rules, then open a path only to the signed-in user who owns that record.

```
{
  "rules": {
    ".read": false,
    ".write": false,
    "users": {
      "$uid": {
        ".read": "auth != null && auth.uid === $uid",
        ".write": "auth != null && auth.uid === $uid"
      }
    }
  }
}
```

#### Are secrets sitting in the generated client?

A service-role key, secret API key, or private token in the JavaScript bundle is already exposed, because the browser downloads that file.
Remove it, rotate it, and keep the replacement in a server-only variable that is not prefixed with NEXT_PUBLIC_ or VITE_.

#### Does hiding an admin link protect the route?

Hiding a link does not protect an admin page or API that still returns data when no session cookie is sent.
The route has to check the session on the server and return 401 or 403 when the cookie is missing.

#### Can a visitor skip a paywall in the browser?

A premium flag that lives only in client state can be changed in the browser, and a payment webhook that does not check a signature can be called by anyone.
Enforce the purchase on the server, and verify the webhook signature before granting access.

#### What will a VibeCheck report not promise?

A finished report is a point-in-time list of findings and fixes for the origin you scanned. VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification.

### Is row level security on for my Supabase tables?

Row level security is on only when every table the client can reach has RLS enabled and a policy that limits rows to the people who should see them; the anon key still ships in the browser.

#### Does the anon key count as a secret?

No. The anon key is meant to be in the client, and it can read any table that grants the anon role or leaves row level security off.
Treat the key as public and lock the tables.

#### How do I check a table before launch?

Request the table with the anon key and confirm you cannot select rows you would not paste into a public chat.
Enable row level security, add a policy, and repeat that request before you ship.

#### What policy should a user-owned table use?

Give the authenticated role a policy that compares the row owner to auth.uid(), and do not add a policy that lets anon select every row.
Repeat that for every table in the public schema the client can touch.

```
alter table public.users enable row level security;

create policy "read own row"
on public.users
for select
to authenticated
using (auth.uid() = id);
```

#### What about storage buckets?

A storage bucket that allows public listing shows every object to anyone who knows the project URL.
Require a signed-in user, and scope the path to that user, before you mark the bucket public.

#### What should I do if the table was already readable?

Assume the rows were copied, rotate any secrets that were in those rows, and turn on row level security before the next deploy.
Changing the policy later does not pull data back from someone who already downloaded it.

#### How does VibeCheck report an open table?

On an origin you own, VibeCheck tries the public client key that the bundle already contains and reports a table that returns rows without a signed-in user.
The paid report includes the location, a short redacted response, and a copy-paste fix. The free teaser can show that the issue exists without that evidence.

### Did my vibe-coded app leak an API key?

An API key is leaked when it appears in JavaScript the browser downloads, in a public file such as .env, or in a variable prefixed with NEXT_PUBLIC_ or VITE_.

#### Which keys are safe in the browser?

A publishable client key, such as a Supabase anon key, is meant to ship in the browser only because server rules limit what it can do.
A service-role key, a secret API key, or a private token is not safe in the browser, because it acts as your server.

#### Why do generated apps leak server keys?

A generator can paste a secret into a client component, or into a NEXT_PUBLIC_ or VITE_ variable, so the browser calls the provider directly.
That file is downloaded by every visitor who opens the app.

#### Where else do keys show up?

Keys also show up in a .env file left on the host, in git metadata, in a source map, and on a debug route that prints the environment.
Those URLs do not need the app UI to be opened.

#### What should I do after a key is exposed?

Rotate the key in the provider dashboard first, because deleting the file does not invalidate a key someone already copied.
Then remove it from the client and from the deploy artifact, store the new value in a server-only variable, and call the provider from a server route that returns only the data the page needs.

#### How does VibeCheck report a leaked key?

VibeCheck reports the file or URL where the credential appeared and redacts the secret in the report.
The free teaser can show that an issue exists. The paid report includes the redacted evidence and the fix steps.

## Draft legal pages

Draft for Nikz to review. This placeholder is not final legal text, not legal advice, and it must be replaced before the site takes payment.

- Terms of service: https://vibecheck.textmatchstudio.com/terms — These draft terms describe the VibeCheck scan service, including ownership proof, point-in-time reports, and the paid plans.
- Privacy: https://vibecheck.textmatchstudio.com/privacy — This draft explains the account, scan, and payment data the current VibeCheck app stores, and it is waiting on Nikz to review it.
- What is the VibeCheck refund policy?: https://vibecheck.textmatchstudio.com/refund — This draft refund policy is for Nikz to review before a payment provider checks the site: paid plans are the $49 report, the $99 report plus rescan, and $29 per month monitoring, plus applicable taxes.
- How do I contact VibeCheck?: https://vibecheck.textmatchstudio.com/contact — Email contact@example.com about a scan, a receipt, or a refund. That address is a placeholder until Nikz replaces it.