Vibe Scan is a free vibe code security scanner for AI-built apps. Made yours with Lovable, Bolt, Cursor or Claude Code? Nearly half of AI-generated code ships with a security flaw, and most of it never gets a second look. Paste your URL and Vibe Scan checks the parts attackers try first. Just wondering who built a site? Try Vibe Check.
A service_role key was found in client-side JavaScript. It bypasses Row-Level Security entirely, so anyone viewing the page can read or write every row in your database.
The service_role key must never reach the browser. Use the anon key client-side with RLS policies and keep service-role calls on the server. Rotate the leaked key in Supabase immediately.
The public.users table has no RLS policy. A single request with the public anon key returns every row, including emails and names.
A common Vite/Next mis-deploy: your .env is downloadable as a static file, exposing API and database credentials.
Your full source tree is reachable through sourcemaps: component names, comments and internal API routes are all readable.
Without a CSP, an injected script can load from any origin. Your strongest defence against XSS is simply absent.
Read-only. Vibe Scan looks at what your site already shows every visitor. It never logs in or submits forms.
Everything below is read from what your site already exposes to the internet. If we can see it, so can anyone else.
Is traffic encrypted, and does the browser get told to keep it that way? Missing headers leave users open to interception and script injection.
API keys and tokens compiled straight into the JavaScript bundle, the single most common vibe-coding mistake, and often billable by whoever finds it.
Endpoints and database rules that answer to anyone with the URL. AI tools scaffold auth screens, they routinely forget to enforce them server-side.
Every script your page loads is code you're trusting. We list the lot, flag the unmaintained, and check what they're allowed to touch.
Sitemaps, source maps, debug endpoints and directory listings that quietly publish more than you meant to.
Which AI builder made the site, and the known weak spots that ship with each platform's defaults.
AI coding tools optimise for "it works on screen". Security is invisible in a demo, so it's the first thing skipped, and the failures repeat so reliably we keep a list. The log on the right is what turns up most, ranked by how often we see it.
The scan finds these from the outside, in about a minute. Fixing them usually takes days, not weeks, that's the audit & fix service.
rk.01Secrets in the client bundle. Anyone can read your JavaScript.seen in most scans
rk.02Database rules wide open, auth screens with nothing behind them. The login is decoration.very common
rk.03No security headers at all. The scaffold never set them.very common
rk.04Debug and admin routes left deployed. /admin, /debug, /test, still live.common
rk.05Source maps published to production. Your entire codebase, readable.common
No wall of jargon. Every finding lands in one of three buckets, with what it means and what to do about it.
Leaked keys, open data, unauthenticated endpoints. Things being exploited in the wild today. We explain each one in a sentence you can forward to whoever built it.
Missing headers, loose CORS, stale dependencies. Not on fire, but each one makes a real attack easier. Most take minutes to fix once named.
Business logic, payment flows and data handling can't be judged from outside. If the scan suggests deeper trouble, the report says so plainly, no scare tactics.
Two free tools, two different questions. Vibe Check tells you what built a site. Vibe Scan tells you what it left exposed.
You want to know whether a public website was built with an AI app builder.
Builder fingerprints: hosting domains, platform scripts, telltale markup.
You own an AI-built app or site and want to see what it leaves exposed.
Public security surface: exposed keys, missing headers, open routes, platform risk.
Last updated July 2026 · Maintained by VibeZero, a Perth AI development and security team.
Yes. The scan is read-only. It looks at what your site already serves to any visitor: pages, headers, public scripts. It does not log in, submit forms, or probe with attack payloads.
No. Everything is assessed from the public URL. That is the point. We are showing you what an attacker can see without any special access.
Any app with a public URL. It is tuned for apps built with Lovable, Bolt.new, Cursor, Claude Code, Replit, Windsurf, v0 and Copilot, plus framework-specific issues in Next.js, React, Vite, Nuxt and Svelte.
Yes, no credit card and no trial period. Results appear on screen the moment the scan finishes. We ask for your name and email so VibeZero can follow up if you want help fixing what is found. We will not spam you.
The report tells you plainly what it is and what to do first. Rotate exposed credentials immediately, then prioritise high and medium findings within the week. You can fix it yourself, hand the report to your developer, or request a free manual audit and we will go deeper.
The scanner reads only public information, the same as visiting the site in a browser. That said, it is built for owners checking their own apps. Please only scan apps you own or are authorised to test.
Most scans finish in 5 to 15 seconds. Larger apps with many JavaScript files can take up to 20.
It is a free tool that shows its working. Most people fix the findings themselves or with their own developer. Some ask us to do it, that is the business model, and it only works if the report is honest.
Findings fixed by senior engineers, quoted fixed upfront.