Is your vibe-coded app leaking data?
Paste your Lovable, Bolt, Replit or Cursor app URL. In about a minute you'll see what any stranger's browser can see: leaked keys, open Supabase tables, exposed files. Every issue comes with a fix prompt you can paste straight back into your AI tool.
Scan your app.
No signup. Passive, read-only checks. 5 scans per hour.
What it checks.
Everything a normal visitor's browser can see. Nothing more.
~15 key formats in your HTML and JS bundles: OpenAI, Anthropic, OpenRouter, Stripe, Supabase service_role, AWS, GitHub, Resend, SendGrid, Slack. Your public Supabase anon key is listed separately — it's expected.
Using only the public anon key from your site, we ask ~20 common tables (users, profiles, orders…) for a row count. We never download your data.
Publicly downloadable environment files, git folders and source maps that hand out your secrets or source code.
HTTPS, Strict-Transport-Security, Content-Security-Policy, clickjacking protection, nosniff and referrer policy.
Pricing.
Start free. Go deeper when you need certainty about your data.
What a stranger's browser sees: leaked keys, common open tables, exposed files, headers.
Scan freeEverything in the free scan plus your actual RLS policies — every table, every policy — full fix prompts and a downloadable report.
Coming this weekRe-check after every big AI edit, or cover several apps. Credits don't expire.
Coming this weekWeekly re-scan and an alert when something new appears. Founding price, locked for life.
Start monitoringMonitoring's automatic weekly re-scan with email alerts is coming within 2 weeks; until it ships, we run your re-scans and email you the results. Cancel anytime. Payments by Stripe. Already have a credit code? Run a Deep Scan ›
Honest limitations.
A smoke alarm, not a full audit.
- Outside-in only. VibeGuard sees what a normal visitor's browser sees. It is not a penetration test.
- No logged-in testing. It can't test what signed-in users can access.
- Common table names only. Tables with unusual names aren't checked.
- No server-side view. It can't see your server code, storage buckets, Edge Functions or rate limits.
- Clean ≠ secure. A clean report means "nothing obvious found". Only scan apps you own.