security checks for vibe-coded apps
VibeProtect checks the app you built with Lovable, Replit, Bolt or Cursor, and the code behind it. It finds leaked keys and database rules that let anyone in, then hands you a prompt that fixes each one, written for your builder.
Free for one app. No card, no install.
what we find
AI builders are great at making things work. They are less careful about who else can use what they made. These are the common ones, and the ones we check for.
Anything your app's code holds, every visitor downloads. A key in there is a key anyone can copy and spend.
Builders sometimes flip a setting literally named dangerouslyAllowBrowser. It hands your AI key to every visitor.
The service_role key ignores every access rule. In front-end code it means anyone can read, change or delete all of your data.
Your Supabase anon key is meant to be public. Row Level Security is what stops it reading everything. We read your migrations and flag every table that never turned it on.
Rules left in test mode let anyone on the internet read or write your data without signing in. We read the rules files in your repo.
Keys pasted into code, or a whole .env file, get synced to GitHub along with everything else. We find them and tell you which to rotate.
Your app runs on hundreds of open source packages. We look up the exact versions you have and tell you what to bump.
Server code that lets any site call your API with your users' cookies attached. A page they visit somewhere else could read their data.
Headers, HTTPS, forms and the rest, each in one plain sentence.
the fix is a prompt
Every finding comes with a prompt worded for the builder that made your app. Paste it in, let it make the change, rescan. No security course required.
Anyone who visits your app can read your OpenAI key in the JavaScript their browser downloads. Whoever copies it can use it on your bill.
Step one is yours: revoke the key in your OpenAI dashboard and make a new one. Deleting it from the code does not un-leak it.
Security fix: my OpenAI API key is in the front-end code, so anyone visiting the site can copy it.
Move the OpenAI call into a Supabase Edge Function, store the new key as a Supabase secret named OPENAI_API_KEY, and have the front end call that function instead.
Remove the key from every front-end file and from any VITE_ environment variable. Do not change the UI.
how it works
The URL it is live at. We tell which builder made it from the address and the code.
We give you a prompt. Your builder adds a tiny file to prove the app is yours.
You get a grade and a short list, worst first, in plain language.
Copy the prompt for each finding into your builder, then rescan to see it go green.
the rule we do not bend
A scanner that checks any URL you type is a tool for snooping on other people's apps. So before the first scan, you show us the app is yours, and we re-check that every night.
VibeProtect-Scanner/1.0 (+https://vibeprotect.dev/scanner).Your builder adds it to the public folder.
https://myapp.lovable.app/.well-known/vibeprotect.txt
One line in the head of your home page.
<meta name="vibeprotect-verification" content="vibeprotect-verify=...">
A TXT record, if you have your own domain.
_vibeprotect.app.example.com TXT "vibeprotect-verify=..."
pricing
questions
Yes. We read what any visitor could already read: your pages, the JavaScript they load, your headers and your HTTPS setup. We never try to log in, guess passwords, send attack traffic or write anything. And we only scan an app after you prove it is yours. The repo scan reads your code through our GitHub App and never runs it.
We never store secret values or anything from your database. When we find a key we keep a
redacted version (like sk-proj-Ab…9xQ), enough for you to know which key to
rotate and not enough to use it, plus the file and line where it was. We never read rows from
your database at all. Your repo is read for the scan and not kept afterwards.
Use both. Lovable's check looks at your project from the inside, while you build. VibeProtect looks at the published app from the outside, the way a stranger would (what is in the JavaScript you actually shipped, how the site is served), and scans the GitHub repo Lovable syncs to for committed secrets, vulnerable packages and Supabase migrations without RLS. It works the same way for apps from Replit, Bolt, v0 or Cursor.
Yes. The live app scan only needs your app's address. It finds leaked keys in your JavaScript, AI SDKs running in the browser, and problems with headers, HTTPS and forms. Connecting GitHub (on paid plans) adds the repo scan: committed secrets, vulnerable packages, Supabase migrations without RLS, Firebase rules files and risky code. If your app uses Supabase or Firebase, the repo scan is where its access rules get checked.
Not at all. Every finding starts with what it means for you, and comes with a prompt you paste into the builder that made your app. It knows what RLS is, so you do not have to.
Because we will not scan an app for someone who does not own it. Verifying takes one prompt: we give you the exact words, your builder adds a small file or tag, and you are done. See how verification works.
One app is free, no card. The hardest part is asking your builder to add a file.