Is your vibe-coded app leaking?
Free tool
Paste your app's address. In under a minute we check it for leaked API keys, open databases, missing protections and libraries with known holes: the mistakes AI coding tools make most often. Built for apps made with Lovable, Bolt, Cursor, Replit and v0.
No AI and no guesswork: every finding is something the scan actually saw on your live site, with a fix you can paste into your AI editor. A clean result means these checks passed, not that your app has no bugs.
We fetch your site the way a browser would, plus a few standard requests. We keep a record of each scan: the address, the results, the email you send the report to, and your IP address and country. Leaked keys are stored and shown partly hidden. Only scan sites you own or have permission to test.
What we checked
Leaked keys
Stripe, OpenAI, Anthropic, Gemini, Supabase service keys, GitHub, AWS and more, in your page and its JavaScript.
Open databases
Supabase tables and storage anyone can read without logging in, open Firebase databases, and Supabase sign-ups without email confirmation or with anonymous sign-ins on. Owner scan only; we count rows, never read them, and never try to log in.
Exposed files
Public .env files, .git folders, database backups and debug pages. Owner scan only.
Browser protections
HTTPS, security headers, login-cookie flags, cross-site access (CORS) and clickjacking.
Risky shipping
Dev servers in production, public source maps, error pages that leak internals and security to-do comments.
Known-vulnerable libraries
Library versions we can see, checked against the public OSV vulnerability database.
The check list follows the parts of Cloudflare's open-source security-audit skill that can be tested from outside, on a live site.
Want it fixed and production-ready?
Ship-Ready Sprint
We fix what the scan found, then go where no scanner can: we read your code, test that one user can't reach another's data, check payments and webhooks, and set up backups and error alerts. Fixed scope, priced in writing before we start.