Free
Letter grade
The grade, the score, and finding titles.
For apps shipped with AI tools
Is your vibe-coded app leaking keys?
Free scan in 30 seconds. Paste the URL you already shipped. VibeSafe reads what a visitor can already download and grades the leaks.
$9
Fix Report
Explanation and paste-ready fix prompts. One-time.
$29
10-pack
Ten report credits on your email.
- Passive GET and HEAD only
- No login to your app
- Secrets redacted before they are stored
1
Paste the live URL
Lovable, Bolt, v0, Replit, or whatever you deployed from Cursor.
2
We fetch the public bundle
HTML, scripts, headers, source maps, and a few well-known paths.
3
Leave with a fix prompt
Unlock a prompt per finding and paste it back into the tool that built the app.
What the free scan checks
Keys in the bundle
Stripe secret keys, OpenAI and Anthropic keys, Supabase service_role JWTs, AWS key ids, and public env vars that look like secrets.
Open Supabase tables
If the anon key is in the page, we send one read-only limit=1 request to common tables. A returned row means visitors can read it too.
Security headers
Content-Security-Policy, HSTS, frame protection, nosniff, referrer policy, and permissions policy.
Source maps and dotfiles
Public .js.map files, plus HEAD requests for /.env and /.git. We do not download those files.