Skip to content
VibeVigil
Log inSign up

Your AI-built app is public. A secret key might be too.

You built it with Lovable, Bolt, v0, Cursor, or Replit. People can open the site. VibeVigil reads the public page and the JavaScript. It tells you what is wrong in short words. It gives you a note to paste into your coding tool.

Scan your site freeSee a sample report

No account. You see the report first. You must own the site.

Example

Scan results

  • Exposed key in JS bundle
  • Supabase table: no RLS
  • Security headers

Example

64

Site health

notes.example

Example

Monday report · notes.example

2 new, 1 resolved

  • New: a table with no row security
  • Resolved: the nosniff header is set

Scan a site you own

The check is read-only. No password guessing. No exploit.

Scan a site you own. It is free. No account.

You see the report first. Saving the site is optional.

No account. The report is the next page.

Free, no account. We fetch the public page, its scripts, and a few well-known paths.

A fix note, not a pile of codes

Each finding says what is wrong. Then it gives you a note for Cursor, Lovable, or Claude. Paste it in. Read it before you apply it.

  1. 1

    Add the URL

    You say you own the site. We scan it once.

  2. 2

    Read the report

    Short notes. No raw key. No database row.

  3. 3

    Paste the note

    Your coding agent makes the change. You deploy.

  4. 4

    Get the Monday email

    Paid plans scan every day and email you on Monday.

Example

Copy

Fix note

Move the service role key off the client.
Use the anon key in the browser.
Turn on row level security for that table.

What a scan looks at

Every check is a normal page read.

  • Secret keys in JavaScript

    Service role keys, Stripe and OpenAI secrets, AWS and GitHub tokens. The anon key is fine. The service role key is not.

  • Supabase tables anyone can read

    If we find a project URL and an anon key, we try a read-only select. We keep table names only.

  • Security headers

    Content-Security-Policy, HSTS, framing protection, nosniff, and Referrer-Policy.

  • The HTTPS certificate

    We check that it is trusted, which version it uses, and if it is close to expiring.

  • Files that should be private

    We request /.env, /.git/config, and source maps. A home page returned for every path is not a leak.

  • Is the page up?

    Did the home page answer, and how long did it take?

Pricing

Paid plans are charged up front at Stripe Checkout, before daily scans start. Stripe then bills the same monthly price. There are no surprise charges and no extra scan fees. You can cancel in the billing portal.

Free
One site. Scan it when you want. No card.

$0/mo

  • 1 site
  • You run the scan
  • 1 scan a day
  • Plain words and a fix note
Scan a site free
Pro
Three sites. We scan them every day.

$19/mo

  • 3 sites
  • Daily scans
  • 10 manual scans a day
  • Monday email
  • Email when a new high issue shows up
Pay $19 at checkout
Team
Fifteen sites on one login.

$49/mo

  • 15 sites
  • Daily scans
  • 30 manual scans a day
  • Monday email
  • High-issue alerts
  • One login. No shared seats yet
Pay $49 at checkout

See the report. Then decide.

No account for the first scan. Paid plans are charged at checkout, before daily scans start.

Scan your site free

Questions

VibeVigil — Watch apps you built with AI tools