Is it safe to scan my own site?

The scan is read only. It looks at information the site already serves publicly, including pages, headers and public scripts. It does not log in, submit forms or send attack payloads.

Do I need access to the code?

No. The automated scan works from the public URL and reports what can be observed without source code or account access.

Which vibe coding tools does it work with?

It can scan any application with a public URL. Checks include patterns often seen in apps built with Lovable, Bolt.new, Cursor, Claude Code, Replit, Windsurf, v0 and Copilot, plus selected framework level issues in Next.js, React, Vite, Nuxt and Svelte.

Is the scan really free?

Yes. There is no credit card or trial period. Results appear on screen when the scan completes. The tool asks for contact details before the full report so VibeZero can deliver it and follow up if you request help.

What if the scan finds something critical?

The report explains the issue and the immediate priority. Exposed credentials should be rotated promptly. You can address findings internally, share the report with your developer or request a deeper manual audit and remediation scope.

Will you scan a site I don't own?

The scanner reads public information, but it is intended for owners and authorised testers. Only scan applications you own or have permission to assess.

How long does it take?

Many scans complete in under a minute, but timing depends on the target, network response and number of public assets. A blocked or incomplete scan is labelled rather than presented as a complete result.

Is this a sales funnel?

It is a free automated scanner that shows its findings. You can fix the issues yourself or with your own developer. VibeZero offers paid audit and remediation work for people who ask for deeper help.

Automated public-surface security scan

Find what your AI coder left exposed

Vibe Scan is a free security scanner for public AI-built applications. Paste a URL and it checks the external surface attackers tend to inspect first. The broader risk is material: a Veracode report found security flaws in a substantial share of AI-generated code samples. If you only want to identify the builder, use Vibe Check.

Run the scan See the audit & fix service

Read only and public surface only. Scan applications you own or are authorised to assess.

Interactive scan

Assess the public surface

Enter an authorised public URL. The scanner reports completed, blocked and incomplete checks distinctly so absence of evidence is not presented as a pass.

VS / 01Public-surface scannerUsually under a minute · read only

SampleAn example report, so you can see what you get. Enter your URL above to scan your own site.

Sample reportscanned acme-internal.lovable.appillustrative

run a scan for your own URL

Action needed

2 critical findings

CriticalRotate now

HighFix this week

MediumFix in sprint

PassingHTTPS, cookies…

Findings · 5 issues, sorted by severity

Critical

Exposed secret

Supabase service-role key shipped in the JS bundle

A service_role key was found in client-side JavaScript. It bypasses Row-Level Security entirely, so anyone viewing the page can read or write every row in your database.

file/static/chunks/main-8f2a1.jsline4,128

FIXHow to fix it

The service_role key must never reach the browser. Use the anon key client-side with RLS policies and keep service-role calls on the server. Rotate the leaked key in Supabase immediately.

Critical

Open database

Public table readable with the anon key

The public.users table has no RLS policy. A single request with the public anon key returns every row, including emails and names.

reqPOST /rest/v1/usersstatus200 OK

High

Exposed path

.env file served at the site root

A common Vite/Next mis-deploy: your .env is downloadable as a static file, exposing API and database credentials.

reqGET /.envstatus200 OK

High

Information leak

Source maps published to production

Your full source tree is reachable through sourcemaps: component names, comments and internal API routes are all readable.

path/static/chunks/*.js.map

Medium

Missing header

No Content-Security-Policy set

Without a CSP, an injected script can load from any origin. Your strongest defence against XSS is simply absent.

headerContent-Security-Policy: not set

Pass

Passing check

HTTPS enforced

Pass

Passing check

HSTS preload active

Pass

Passing check

Secure cookies set

Pass

Passing check

X-Content-Type-Options: nosniff

Pass

Passing check

X-Frame-Options set

Pass

Passing check

Referrer-Policy set

Pass

Passing check

No mixed content

Pass

Passing check

TLS 1.3 supported

Illustrative sample. The live scanner returns real findings for your URL

Get findings fixed by us →

Vibe Scan reads what the site already exposes publicly. It does not log in, submit forms or attempt exploitation.

Coverage

Six layers from one public URL

The scanner inspects information already served to the internet. Each layer has a defined scope and can be limited by bot protection, dynamic loading or unavailable assets.

Transport & headers

Browser and transport controls

Checks HTTPS, HSTS and selected browser security headers that shape encryption, framing and script behaviour.

HTTPS / HSTSCSPX-Frame-OptionsCORS

Secrets

Exposed credentials

Looks for API keys, tokens and environment material that appears in publicly served JavaScript or page content.

Model keysPayment tokensService-role keysEnvironment traces

Access

Authentication & access signals

Checks selected public endpoints and patterns associated with missing server side enforcement or overly broad database access.

API routesRLS signalsAdmin pathsIDOR patterns

Dependencies

Third-party surface

Inventories public scripts and selected integrity or maintenance signals around code loaded from other providers.

Script inventorySRIExternal hosts

Exposure

Published data and diagnostics

Looks for source maps, debug routes, public buckets and other material that may reveal more than intended.

Source mapsDebug routesOpen buckets

Context

Platform fingerprints

Notes public markers associated with selected builders so the report can consider common defaults without treating the builder as proof of a flaw.

LovableBoltReplitBase44v0

Why it exists

The review a fast build can skip

A working interface does not demonstrate safe credential handling, server-side access control or production configuration.

Automated triage, with a manual boundary

The scan can name public technical signals and rank their urgency. It cannot determine whether business logic, payment flows, authorisation rules or internal data handling are correct from the outside.

Where the public result suggests deeper risk, the report should be handed to the developer or taken into a manual review. VibeZero's vibe code audit & fix service provides that deeper path.

After the scan

A graded report with an explicit next action

Findings are separated by urgency and by whether the automated scanner has enough evidence to make the call.

Fix now

Critical exposure

Exposed credentials, public data or unauthenticated endpoints require prompt validation and containment. Rotate exposed credentials before broader remediation.

Plan promptly

Weak production defaults

Missing headers, broad CORS or exposed diagnostics should be confirmed and scheduled according to the actual attack path and system context.

Needs a human

Beyond the public scanner

Business logic, payment flows and internal data handling need source, configuration and workflow access that an outside scan does not have.

Choose the question

Builder fingerprint or security posture?

The tools read the same public URL for different reasons and should not be treated as interchangeable.

Vibe Check

What appears to have built this site?

Looks for public builder fingerprints and shows the supporting evidence. Open Vibe Check.

Vibe Scan

What does the public surface expose?

Checks selected security signals and produces a graded, automated report with the limits stated.

Before you scan

Authority, scope and next steps

What the scanner reads, which sites it is intended for, how the report is delivered and what to do with a critical result.

From scan to remediation

Ship quickly, then verify what shipped.

Run the free public scan first. If the result needs source level investigation or remediation, we can scope the deeper work and quote it before implementation starts.

Run the free scan Talk to us about a full audit

Automated scan · manual audit available · fixed scope before work