Find the leaks
before your users do.
Point VibeCheck at a live URL or a read-only GitHub repo. It maps how your app is wired and finds exposed keys, open databases and unprotected endpoints — passively, read-only, with plain GETs. No attacks, no writes, no surprises.
What we actually look for.
Every check is a passive detector that reads what your app already exposes. No payloads, no fuzzing — just the questions a curious stranger would ask in the first five minutes.
service_role key, API token or private key shipped in your JS bundle or left in git log. Full read/write to your backend for anyone who opens DevTools.RLS disabled, an using (true) policy, or wide-open Firestore rules — anyone can read or rewrite every row./api/* route that reads or writes data without checking who's calling. Broken access control — OWASP A01.CSP / HSTS, or Access-Control-Allow-Origin: * paired with credentials — any site can ride your users' sessions.Point it. Scan it. Fix it.
The scanner is a pure read-only observer. It collects evidence, grades it deterministically, and hands you the exact prompt to paste into your editor.
Give it a URL or a repo
Drop in your live domain, or connect a read-only GitHub repo. Nothing is installed and we never ask for write access.
input: url | github (read-only)Passive scan, no attacks
VibeCheck makes plain GET requests and reads what's public — headers, bundles, source, rules. No payloads, no writes, no brute force. ~30 seconds.
method: read-only GET · no mutationsGrade + copy-paste fixes
You get an A–F grade, a 0–100 score, and a ready-to-paste fix prompt for every finding — written for Cursor, Claude or whatever you build with.
output: grade · score · fix prompts# Paste into Cursor / Claude Code My Vite app ships the Supabase service_role key in the client bundle (found in assets/index-4f1.js). Fix it: 1. Remove the service_role key from all client code and from VITE_* env vars (they're public). 2. Move every write that needs it into a server route or Edge Function; keep only the anon key on the client. 3. Rotate the leaked key in the Supabase dashboard — assume it is already compromised. Show me the exact diffs for my stack.
One badge. Bragging rights or a wake-up call.
Every scan gives you an embeddable two-part badge. Drop the markdown in your README and it re-renders your live grade — a quiet signal that you actually checked.
[](https://vibecheck.dev/r/my-saas.app)
Start free. Pay once when it's serious.
The free scan tells you if you're leaking. Pay only when you want every finding, the fixes, and a paper trail.
- A–F grade + 0–100 score
- Top 3 findings, in full
- Embeddable grade badge
- Remaining findings hidden
- All findings, every severity
- Copy-paste fix prompt per issue
- PDF report to share or file
- Passed-checks evidence list
- Re-scan on every deploy
- Alert when the grade drops
- Grade trend over time
- Full audit included each scan
Done-for-you manual audit
A human reviews your app by hand, beyond the automated checks.