🚀 Launch Week — 40% off everything. Use code LAUNCH40 at checkout
⚠ 91.5% of vibe-coded apps have vulnerabilities

Scan before you ship.
Scan after you ship.

VibeSafe runs 24 security checks on your vibe-coded app — source code and live site. Plain-English report, exact fixes, trust badge included.

NEW Penetration Test — $399 →
Start Scanning See all 24 checks
📁 Pre-launch repo scan 🌐 Post-launch live scan ✦ Both together
vibesafe --repo ./my-startup --url https://myapp.com
$ python audit.py --repo ./my-startup --url https://myapp.com

📁 PRE-LAUNCH SCAN
[1/8] Scanning for exposed secrets...
[2/8] Running static analysis (semgrep)...
[5/8] Scanning all source files for hardcoded secrets...
[6/8] Checking API routes for missing authentication...

🌐 POST-LAUNCH SCAN
[1/6] Checking SSL/TLS certificate...
[2/6] Checking security headers (CSP, HSTS, X-Frame)...
[3/6] Checking for exposed .env and .git files...
[4/6] Scanning JavaScript bundles for secrets...

🔴 CRITICAL Supabase anon key hardcoded in frontend JS
🔴 CRITICAL Row Level Security disabled on users table
🔴 CRITICAL HSTS header missing — connections can be downgraded
🟠 HIGH API route /api/data missing auth check
🟠 HIGH No rate limiting on /api/auth/login

✅ Report saved → vibesafe-report.md
🏅 Trust badge → vibesafe-badge.html
Fix issues above to display badge on your site.
Scan your app

Get your free security report.

Enter your live URL and email. We'll scan it and send you the results.

Free scan. Full report delivered to your inbox.

✅

Scan started!

We're scanning your app now. You'll receive the full report at your email within 5 minutes.

In the meantime, check out our Security Guide.

⚠ Real incident — 2025

Quittr hit $1M in revenue and got an Oprah mention. Their Firebase database was publicly readable the entire time — all 39,000 users' data exposed. They found out from a security researcher. Not because someone stole the data. This time.

$1M
revenue while exposed
39K
users at risk
0
security checks run
380K
vibe-coded apps exposed online
24 checks

Everything that can leak, break, or get you hacked.

Pre-launch catches what hasn't shipped yet. Post-launch catches what's already live. Run both.

📁 PRE-LAUNCH — source code checks (10)

01
🔑
Exposed Secrets
Trufflehog scans every file for API keys, tokens, and passwords before they ship.
Critical
02
🔬
Static Analysis
Semgrep + OWASP top-10 ruleset catches injection, XSS, and insecure patterns in JS, TS, and Python.
High
03
🗄
Supabase RLS
Detects Row Level Security disabled in migrations. 70% of Lovable apps ship with RLS off.
Critical
04
🔥
Firebase Rules
Finds open Firestore and Realtime Database rules that allow public read/write access.
Critical
05
📄
Hardcoded Credentials
150+ secret patterns scanned across all .ts, .js, .py, .env, .yaml files — not just dotenv files.
Critical
06
🚪
Unprotected Routes
Finds Next.js App Router, Pages Router, Express, Flask, and FastAPI routes missing auth checks.
High
07
💳
Stripe Webhook Verification
Detects webhook handlers that accept Stripe events without verifying the signature — allows fake payments.
High
08
💉
SQL Injection
Catches string concatenation and f-strings used to build SQL queries with user input.
High
09
📦
Dependency Audit
Checks package.json/lock files against known CVEs. AI tools often pull in outdated packages with public exploits.
High
10
🗄️
DB Config Exposure
Flags exposed Neon, PlanetScale, Supabase connection strings and hardcoded DB URLs in config files.
Critical

🌐 POST-LAUNCH — live site checks (11)

01
🔒
SSL/TLS Certificate
Checks cert validity, expiry date, and TLS version. Flags weak TLS 1.0/1.1 and certs expiring within 30 days.
Critical if expired
02
🛡
Security Headers
Tests HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
High
03
📂
Exposed Sensitive Files
Probes for publicly accessible .env, .env.local, .git/config, and source maps on your live domain.
Critical
04
📦
Secrets in JS Bundles
Downloads and scans your production JavaScript bundles for API keys embedded by AI coding tools.
Critical
05
🌐
CORS Misconfiguration
Sends a malicious Origin header and checks if your server reflects it — enables cross-site request forgery.
Critical if wildcard+credentials
06
🚦
Rate Limiting
Probes auth endpoints for rate-limit headers. No rate limiting = brute-force attacks are trivial.
Medium
07
💥
Data Breach Check
Checks your domain against HaveIBeenPwned. Breached credentials power credential-stuffing attacks.
High if found
08
🏅
Trust Badge
Pass with no critical/high issues and earn an embeddable badge for your landing page. Auto-generated.
Earned
09
🗺️
Source Map Check
Checks if .js.map files are publicly accessible. Exposed source maps leak your full uncompiled code.
High if exposed
10
🍪
Cookie Security
Audits Secure, HttpOnly, and SameSite flags on all cookies. Missing flags enable session hijacking.
High if missing
11
🌐
Subdomain Probe
Scans 20 common subdomains (dev, staging, admin, api) to find exposed environments.
Low
Trust badge

Prove your app is safe.

Pass your scan with no critical or high issues and get an embeddable badge for your landing page. Publicly verifiable, auto-generated after every clean scan.

✓
Security Verified
VibeSafe · 2026-06-02

Paste one line of HTML anywhere on your site. Updates automatically when you re-scan.

How it works

Three steps. Full coverage.

Catch issues in your code before they ship. Catch what slipped through after they're live.

01 / 03
📋
Submit repo + URL

Share your GitHub repo link for pre-launch scanning and/or your live domain for post-launch scanning. Both together = complete picture.

02 / 03
📄
Get your plain-English report

Within 24 hours — every finding explained in plain English. Severity, what it means for your users, and the exact code or config to fix it.

03 / 03
🏅
Fix, re-scan, earn badge

Fix the issues. Re-run the scan. If you clear all critical and high findings, your trust badge is auto-generated and ready to embed.

vs the competition

The only scanner that covers both.

Other tools scan either your code or your live site. VibeSafe does both — from source code to production headers.

Feature VibeSafe VAS Snyk / Checkmarx
Pre-launch repo scan✓✗✓
Post-launch live URL scan✓✓✗
SSL/TLS checker✓✓✗
Security headers✓✓✗
Secrets in JS bundles✓✓✓
Supabase RLS (code)✓Partial✗
Stripe webhook verification✓✗✗
Data breach check (HIBP)✓✗✗
Trust badge✓✓✗
AI Security Rules (CLAUDE.md)✓ Included✗✗
Plain-English for founders✓✓✗ Dev-only
One-time pricing✓✓✗ Enterprise
NEW — Early Access

Need a real penetration test?

The scanner tells you what might be vulnerable. We actually exploit it — proving exactly what an attacker can access, delete, or steal.

🔴 XSS Testing
Inject payloads into every form, URL, and input. Prove whether scripts execute.
🗄️ Database Access
Test Supabase RLS, Firebase rules, and SQL injection with real exploit attempts.
🚪 Auth Bypass
Hit every protected route without credentials. Find endpoints that leak user data.
💳 Payment Logic
Test Stripe webhook verification, price manipulation, and checkout bypass attempts.
🔐 Session Hijack
Check cookie security, JWT handling, token leakage in Referer headers and URLs.
📋 Config Review
Review CORS, CSP, storage buckets, env exposure, and dependency CVEs manually.
$399
one-time
48 hours
turnaround
Written Report
with exact fixes
→ Request a Pentest

Early access — limited to first 100 customers at $299. Use code PENTEST100 at checkout.

Pricing
🌐 Post-Launch
$19 one-time
📁 Pre-Launch
$39 one-time
📦 Full Bundle
$49 $58 save $9
BEST VALUE
🔁 Continuous
$39/month
Pre-Launch Checks (source code)
Exposed secrets (trufflehog)—✓✓—
Static analysis (OWASP top-10)—✓✓—
Supabase RLS + Firebase rules—✓✓—
SQL injection + auth routes—✓✓—
Dependency CVE audit—✓✓—
Post-Launch Checks (live URL)
SSL/TLS + security headers✓—✓🔄 weekly
Exposed .env / .git / source maps✓—✓🔄 weekly
Secrets in JS bundles✓—✓🔄 weekly
CORS + rate limiting✓—✓🔄 weekly
Data breach check (HIBP)✓—✓🔄 weekly
Trust badge✓—✓🔄 weekly
Delivery & Support
Report in 24 hours✓✓✓auto
Plain-English with exact fixes✓✓✓auto
FAQ

Common questions

What's the difference between pre-launch and post-launch scanning?
Pre-launch scans your source code repo — catching secrets, SQL injection, and missing auth before anything goes live. Post-launch scans your live URL — checking SSL, security headers, exposed files, and JS bundles the way an attacker would. Run both for complete coverage.
Do I need to be technical to use this?
No. Every finding is written in plain English — what's wrong, why it matters to your users, and the exact code to fix it. You don't need to know what CSP, RLS, or CORS means.
What stacks and tools do you support?
Any app with a GitHub repo — built with Lovable, Bolt, Cursor, v0, Replit, Windsurf, or any AI tool. Backends: Supabase, Firebase, Railway, Neon, PlanetScale. Languages: JS, TS, Python.
How does the trust badge work?
After your scan, a badge HTML file is auto-generated. If you pass with no critical or high findings, the badge shows "Security Verified" in green. Embed it on your landing page in one line of HTML.
Is my code kept private?
Yes. Your repo is scanned and immediately deleted. We never store, share, or train on your code. For live scans, we only send the same requests a browser would send.

Don't find out the hard way.

Quittr had $1M in revenue and 39,000 exposed users. Most founders find out from a security researcher — or from a news article.

Scan My App Now →

Starting at $19 · 24 security checks · Report in 24 hours