Free security scan · no card · read-only
Find the security holes in your AI-built app before attackers do.
Built with Lovable, Bolt, Cursor or v0? Paste your site's URL. Get a plain-English report with a fix prompt for every issue.
How it works
Three steps. About an hour. Zero setup.
- 01
Enter your site or repo
Your live site's URL, or any public GitHub repo for the deeper code audit. Add the email where the report should go. No account, no card.
- 02
We read the code, read-only
Secret scanners, static analysis and vibe-coding checks run on a temporary copy that is deleted after the scan. We never touch your live app.
- 03
Fix with one paste
Your report lands by email, usually within about an hour. Each finding comes with a fix prompt for Cursor, Lovable, Bolt or Claude Code.
What we check
The mistakes AI builders make most.
Generic scanners miss what vibe-coded apps get wrong. These checks are built for that stack.
- Secrets
Leaked keys & secrets
API keys, tokens and service-role keys committed to the repo, behind NEXT_PUBLIC_/VITE_ prefixes, or baked into committed bundles.
- Database
Supabase & Firebase rules
Tables without RLS, USING (true) policies, public storage buckets, edge functions with verify_jwt off, open Firebase rules.
- Payments
Stripe webhooks
Webhook handlers that never verify the Stripe signature, so anyone can fake a 'payment succeeded' event.
- Exposure
Exposed .env & source maps
Committed .env files, and build output or source maps in the repo that leak credentials to anyone who fetches them.
- Dependencies
Next.js & dependency CVEs
Known vulnerabilities in Next.js, React and every other dependency, checked against the public OSV database.
- Vibe checks
AI-specific footguns
Unauthenticated server actions and API routes, hallucinated packages, hidden-unicode instructions in agent rules files.
Sample report
What you get back.
A real Full audit of a public repo, redacted. Every finding is ranked by severity, explained in plain words and paired with a prompt you paste into your AI builder.
- Severity, file and line for each issue
- Why it matters, in one sentence
- A copy-paste fix prompt
Full audit · redacted
github.com/xxxxxx/xxxxxxxxxxxx
- findings
- 25
- findings
- critical
- 15
- critical
- high
- 7
- high
- files read
- 989
- files read
Public env prefixes (NEXT_PUBLIC_, VITE_) ship to every visitor. The service-role key bypasses all RLS policies.
Fix prompt · paste into Cursor / Lovable
Move every call that needs this secret to a server-side route or Supabase Edge Function, use only the anon key in the client, and tell me which key to rotate.
Excerpt from a real scan of a public repo. Repo, owner and file names redacted; secret values are never shown in reports.
How we work
Built to be trusted with your code.
Responsible disclosure
When we find a serious issue in someone else's public code, we report it privately to the owner first. We never publish secrets or name projects.
Read-only, passive
Repo scans only read your code. Website scans make at most 40 plain GET requests to your homepage, its own scripts and public files like robots.txt, like a single visitor. No attacks, no logins, no form posts, no write access requested.
Code deleted after the scan
The temporary copy is removed when the scan finishes. Reports and scan records are deleted automatically after 7 days. Your code is not used to train AI.
GDPR · EU company
Run by Mosselaer Holding B.V. in the Netherlands, under the GDPR. Privacy policy and Impressum are public.
Pricing
Start free. Pay once if you want more.
One-time prices. No subscription.
Free scan
€0
- Secrets + Supabase RLS check
- Issue count + launch grade
- Your #1 launch blocker, explained
Quick
€19
- Top 10 launch blockers
- Fix prompt + verify check each
- 1 free re-scan
Full
€39
- Every finding + fix prompt
- AI review: bugs, auth, performance
- API-cost simulator
Pro
€49
- Everything in Full
- 3 re-scans in 14 days
- Verified badge, 30 days
Building for clients? Agency packs of prepaid Full audits →
FAQ
Questions, answered.
Is the free scan really free?
Yes. No card, no account. It checks secrets and Supabase RLS, gives you an issue count and a launch grade, and fully explains your top launch blocker. Paid audits are one-time payments, never a subscription.
Do I need a GitHub repo?
No. Enter your site's URL for a free, passive check of what anyone can see: HTTPS, security headers, cookie flags, and keys or source maps leaking from your public JavaScript. For the deeper audit (Supabase RLS in your migrations, dependencies, server code), paste a public GitHub repo instead.
Do you attack my live app?
No. The free website scan is passive and runs only after you confirm you own the site or have permission: it loads your homepage, the scripts and stylesheets it links to on your own domain (and their source maps if they are public), robots.txt, sitemap.xml and security.txt. It never guesses paths, logs in, submits forms or uses a key it finds. Repo scans only read the code in your public repository. The optional Pro live check runs only after you verify the site is yours: it loads that page and a few of its script files. If your app uses Supabase, it uses your public (anon) key to list your tables and storage buckets and count rows, the same access any visitor has. It never writes data and runs no exploits.
What happens to my code?
It is cloned into a temporary directory on our scan server and deleted when the scan finishes. Reports and scan records (including your email) are deleted automatically after 7 days. We don't train AI on your code.
My app was built with Lovable / Bolt / v0. Does it work?
Yes. Enter your published app's URL (for example yourapp.lovable.app) for the free website check. For the full code audit, connect your project to GitHub from the builder and paste the repo URL. Next.js, React, Vite, Supabase, Firebase and Stripe are what we know best.
Do I need to be a developer to read the report?
No. Each finding explains the risk in plain language and comes with a prompt you paste into the AI tool you already build with.
How do I verify my live site for the Pro live check?
Use one of three methods: a DNS TXT record fixmyvibe-verify=<your token> on your domain, a fixmyvibe-verify meta tag in the page head, or the file /.well-known/fixmyvibe.txt. The meta tag and the file only count if the URL you enter is the final URL: a redirect to another host is not followed, so if example.com redirects to www.example.com, enter the www address. They also prove control of that one host only, which matters on shared hosts like yourapp.vercel.app. If your site redirects across hosts or you can't edit its pages, use the DNS TXT record.
Is this a guarantee my app is secure?
No audit can promise that. You get a prioritised list of what we found and how to fix it. If a paid scan fails on our side, we refund you.
Ship it. Safely.
Enter your site or repo and get your free security scan, usually within about an hour.
Built with
Security checklists for your AI tool.
Security guides