Was this website vibe coded?
Vibe Check is a free vibe code checker for public websites. AI website builders leave fingerprints: script tags, hosting domains, markup patterns. Paste any public URL and Vibe Check looks for them, then shows you the evidence rather than just a verdict. Worried about what the builder left exposed? That's Vibe Scan.
Every builder leaves a signature
These are the markers we look for, per platform. When we call it, you see exactly which one matched. Prefer to check by hand? The seven signs are here.
Lovable
The loudest fingerprint of the lot: a tracking script most users never remove, plus platform hosting.
Bolt.new
Quieter, but the hosting and build artefacts usually give it away.
Replit
Platform domains and a development banner that often ships to production.
Base44
Hosted apps carry the platform domain and API endpoints in page requests.
v0 / Cursor / Claude Code
Code-first tools export clean code with few platform markers. Here we rely on markup patterns, and say so when confidence is low.
Where the checker goes quiet
A fingerprint checker is only useful if it admits what it cannot see. When the evidence is thin, Vibe Check says "no fingerprint found". It never guesses to look clever.
And to be clear: vibe-coded is not an insult. Plenty of good sites are AI-built. The question that matters is whether it was built safely, which is a different tool.
lim.01Code-first tools leave almost nothing. Cursor and Claude Code output is just... code.
lim.02Cleaned-up sites lose their markers. A developer who removed the tracking script beat the check.
lim.03A fingerprint says nothing about quality. It tells you the tool, not whether it was used well.
Knowing what built it is the easy part. Knowing what it left exposed is the useful part
If Vibe Check says a site was AI-built, yours, a supplier's, one you are about to buy, the follow-up question is security. Vibe Scan reads the same public surface and grades what is actually at risk: leaked keys, open databases, missing guardrails.
Vibe Check or Vibe Scan?
Two free tools, two different questions. Vibe Check tells you what built a site. Vibe Scan tells you what it left exposed.
Vibe Check
you are hereYou want to know whether a public website was built with an AI app builder.
Builder fingerprints: hosting domains, platform scripts, telltale markup.
Vibe Scan
Check the securityYou own an AI-built app or site and want to see what it leaves exposed.
Public security surface: exposed keys, missing headers, open routes, platform risk.
Last updated July 2026 · Maintained by VibeZero, a Perth AI development and security team.
Asked before checking
Lovable apps load a small runtime script from cdn.gpteng.co (gptengineer.js), and many are served from a lovable.app address. Either of those on a page is a strong sign the site was built with Lovable. If both have been removed, it gets much harder to tell.
Bolt and Replit apps usually sit on their own hosting (bolt.host, replit.app), which is the clearest signal. v0 is different: it gives you code to host yourself, so a finished v0 site often has no fingerprint at all. We are honest about that in the result rather than guessing.
No, and nothing reliably can. Cursor, Claude Code and Windsurf are coding tools, not hosts or platforms. A site built with them looks like ordinary hand-written code, so there is no marker to find. If the checker says no fingerprint, that is one of the reasons why.
No. Markers are easy to remove. A site can be entirely AI-built and still come back clean once it is on a custom domain with the builder's badge taken off. Treat a clean result as no evidence either way, not proof.
Not on its own. The issue is that AI builders often ship code with security gaps the owner never sees, such as exposed keys or a database with no access rules. The build tool is not the problem; unchecked output is. If a site was vibe coded, the sensible next step is a security check.
When it finds a builder fingerprint, it shows you the exact thing it found and where, so you can judge it yourself. It only names a builder on strong, hard-to-fake signals. It is an indicative read from public markers, not a definitive statement about how a site was built.