for apps built with Manus
Manus builds the whole thing for you: the pages, a backend, a database, sign-in and hosting on manus.space. That is a lot of code nobody has read. We check the published app from the outside, and once you turn on Manus's GitHub sync we review the code behind it, with every fix as a prompt you paste back into Manus.
7-day free trial. No card, no install.
what usually goes wrong
Manus writes a backend for every feature you describe. If one of its endpoints returns or changes data without checking who is signed in, anyone who finds the address can call it. Pattern checks miss most of these, so an AI code review reads the backend for them.
Ask for "an AI feature" or "Stripe checkout" and the key has to live somewhere. If it lands in the frontend, it ships in the JavaScript every visitor downloads. We read the published bundle for more than 40 kinds of key.
If the app talks to a Supabase or Firebase database from the browser, we use the same public settings it ships to ask for one row without signing in. If it answers, you know for sure, and we keep only the column names.
Manus pushes every change to the GitHub repo you export to. We scan it on each push: committed keys, packages with known holes, database rules, and the code itself, so a prompt that opens a hole shows up before a stranger finds it.
the fix is a prompt
The kind of bug only a code review finds, and the prompt that comes with it:
The orders.list endpoint returns orders for whatever user id the browser sends, and never checks that it belongs to the person signed in. Anyone can change the id and read other customers' orders.
Security fix: the orders list endpoint takes a userId from the request and returns that user's orders without checking who is signed in, so anyone can read other customers' orders.
Make the endpoint require a signed-in user and use that user's id from the session, ignoring any userId sent by the browser. Do the same check on every endpoint that reads or changes orders.
Do not change the UI. Show me each endpoint you changed.
verify your app
Verify the address people actually visit: your manus.space address or your own domain. The quickest proof is a small file or a tag in the page, and Manus can add either.
_vibeprotect.<your domain> works too. On manus.space only Manus controls DNS, so use the file or the tag.Add a site verification for VibeProtect. Create the file public/.well-known/vibeprotect.txt containing exactly this single line:
vibeprotect-verify=3kQ9xZr1VbN0aT7mYw2cLp8e
Also add this tag inside <head> in index.html (or the root layout's metadata):
<meta name="vibeprotect-verification" content="vibeprotect-verify=3kQ9xZr1VbN0aT7mYw2cLp8e" />
Do not change anything else.
Your real token is in the app once you add it. The file ends up at /.well-known/vibeprotect.txt.
questions
Manus can sync a project to GitHub (in the project's Settings, GitHub tab), and from then on it pushes every change there. Connect that repo to VibeProtect on a paid plan and we scan it on each push, including the AI code review. Without it, the live app scan still works on its own.
The one people visit. We recognise manus.space addresses automatically; on your own domain, pick Manus as the builder when you add the app so the fix prompts are worded for it.
They are written to change only what the finding is about and to leave the UI alone. Check your app after each fix, the same as after any prompt, and rescan to confirm it is gone.
Seven days free, no card. The hardest part is asking Manus to add a file.