# VibeCheck

> VibeCheck is a security scanner for vibe-coded apps that checks a Lovable, Bolt, Cursor, Replit, v0, Supabase, or Firebase app you own and reports leaked keys, open databases, missing authentication, and other launch issues.

VibeCheck scans origins you prove you own. Reports are a point-in-time look at findings and fixes, not a certification.

## Pricing

A VibeCheck scan costs $0 for a teaser, $49 for a full report, $99 for that report plus one fix rescan, or $29 per month for monitoring, plus applicable taxes.

- Free teaser ($0): Run a scan and see severity counts plus two sample issues. The rest of the report stays locked. Logged-in checks are available in the full report.
- Full report ($49 one-time, plus applicable taxes): Unlock the full report for one scan: every finding, evidence, copy-paste fixes, and signed-in checks with throwaway test accounts.
- Report + rescan ($99 one-time, plus applicable taxes): Full report on this scan, including signed-in checks with throwaway test accounts, plus one credit to rescan after you ship fixes.
- Continuous monitoring ($29 per month, plus applicable taxes): Scheduled rescans of a verified app and an alert when a new high-severity issue shows up.

plus applicable taxes

## What VibeCheck checks

VibeCheck checks a vibe-coded app for leaked API keys, open Supabase row level security and Firebase rules, missing authentication, user IDs in URLs, paywall bypass, exposed env and admin routes, weak security headers, and related launch issues.

- Leaked API keys: VibeCheck looks for private credentials in downloaded JavaScript and on public paths, including service-role keys and secrets placed in NEXT_PUBLIC_ or VITE_ variables.
- Supabase row level security: VibeCheck checks whether a table or realtime channel can be read or written with the public anon key that the app already ships to the browser.
- Firebase security rules: VibeCheck checks whether the Firebase project returns data to a request that has no signed-in user.
- Missing authentication: VibeCheck requests admin pages and APIs without a session to see whether they return privileged data.
- User IDs in URLs: VibeCheck checks whether substituting another sequential id on a read-only request returns someone else's record.
- Paywall bypass: VibeCheck checks whether a premium feature is enforced only in the browser, or a payment webhook accepts a body with no signature.
- Exposed env files: VibeCheck requests paths such as .env, .git metadata, and source maps that should never be on a public host.
- Security headers, CORS, and cookies: VibeCheck checks HTTPS, Content-Security-Policy, HSTS, cookie flags, and CORS that allows any origin with credentials.
- Open storage buckets: VibeCheck checks whether a storage bucket or upload folder can be listed without a signed-in user.
- Open AI routes: VibeCheck checks whether a model route answers without authentication, has no rate limit, or returns a system prompt.

## Key pages

- [Ship the vibe. Check the doors.](https://vibecheck.textmatchstudio.com): Product overview and the one-sentence definition.
- [How much does VibeCheck cost?](https://vibecheck.textmatchstudio.com/pricing): Free teaser, full report, rescan, and monitoring.
- [Frequently asked questions](https://vibecheck.textmatchstudio.com/faq): Short questions and direct answers.
- [How does a VibeCheck scan work?](https://vibecheck.textmatchstudio.com/how-it-works): Ownership proof, consent, and what the scan requests.
- [What should I read before a VibeCheck scan?](https://vibecheck.textmatchstudio.com/guides): Index of the security guides.
- [Is my Lovable app secure?](https://vibecheck.textmatchstudio.com/guides/is-my-lovable-app-secure): What to verify on a Lovable app before launch.
- [Is row level security on for my Supabase tables?](https://vibecheck.textmatchstudio.com/guides/supabase-rls-checklist): Supabase row level security checklist.
- [Did my vibe-coded app leak an API key?](https://vibecheck.textmatchstudio.com/guides/leaked-api-keys-vibe-coding): How a vibe-coded app leaks an API key and what to do.
- [What does a VibeCheck report look like?](https://vibecheck.textmatchstudio.com/demo-report): Sample report UI with invented data, not a live scan.
- [Terms of service](https://vibecheck.textmatchstudio.com/terms): Draft terms. Not final.
- [Privacy](https://vibecheck.textmatchstudio.com/privacy): Draft privacy notes. Not final.
- [What is the VibeCheck refund policy?](https://vibecheck.textmatchstudio.com/refund): Draft refund policy. Not final.
- [What is the VibeCheck scanner?](https://vibecheck.textmatchstudio.com/scanner-info): How a scan identifies itself, and how to report abuse.
- [How do I contact VibeCheck?](https://vibecheck.textmatchstudio.com/contact): Placeholder contact email and the abuse mailbox.
- [llms-full.txt](https://vibecheck.textmatchstudio.com/llms-full.txt): longer product, pricing, FAQ, and guide text for language models.