AvailableFounders who shipped with AI builders

VibeCheck

Find out if your AI-built app leaks data. In one minute.

A read-only security scanner for apps built with Lovable, Bolt, Replit, v0, Cursor or Claude. Paste your URL, get a grade and a list of what's exposed — each with a copy-paste prompt that fixes it.

~1-minute scan, 20+ secret-key types, 13 check groups, free grade — €18 full report.

€18one-time, per app — scan is free

Scan your app — free Read the guides

Watch the full walkthrough (1:16)

Features

What it does

Leaked secret keys
Supabase service_role, Stripe, OpenAI, Anthropic, AWS, Resend and 20+ more — found in the JavaScript your app sends to every visitor.
Open databases
Supabase tables without Row Level Security, listable Storage buckets, open Firebase databases. Measured by row count only — data is never downloaded.
Exposed files and functions
Public .env, .git and SQL backups, source maps, Edge Functions and RPCs callable without login, admin checks that only exist in the browser.
A fix you can paste
Every finding comes with a prompt for your builder. The full report adds one prompt that fixes everything, ordered by severity.

Process

How it works

Paste your app's URL

Confirm you own it. No meta tag, no DNS record, no install.

Get a grade in ~1 minute

Free: the grade, how many problems, how severe, and what each one is.

Unlock the full report

€18 once: evidence plus a copy-paste fix for every finding.

Re-scan and stay covered

Free re-scans for 7 days, then weekly monitoring for 30 days — email only when something new shows up.

Walkthrough · 1:16

Start to finish, one real site

What you get

Evidence for every finding (counts and data types, never the data)
A copy-paste fix prompt per finding
One prompt that fixes everything, ordered by severity
Free re-scans for 7 days
Weekly monitoring for 30 days
Public "verified" badge once no critical or high issues remain

What you need

A live app you own (or have permission to scan)
Built with Lovable, Bolt, Replit, v0, Cursor, Claude, Codex — or anything else

FAQ

Questions

Does it attack my app?
No. It only reads what your app already serves to every visitor. Nothing is guessed, written or changed.
Do you see my users' data?
No. Open tables are measured by row count only. Secrets are masked in the report. Scans are deleted after 30 days.
Is it a subscription?
No. €18 once per app. Monitoring for 30 days is included.
What if a check can't run?
It's marked as an error with the reason — never as a pass. The report says so under the grade.