Exposed backend access
Your Supabase anon key and Firebase config ship to the browser by design. We confirm whether they actually read data that Row-Level Security or rules should protect - not just whether a policy exists.
Built for Lovable · Bolt · v0 · Cursor · Replit
Your AI builder shipped fast.
Did it ship safely?
Lovable, Bolt, v0, Cursor and Replit generate working apps in minutes - and routinely leak Supabase keys, skip Row-Level Security, and bake secrets into the browser bundle. VibeSafely scans for those exact flaws and hands you the fix, before someone else finds them first.
Understands the stacks AI builders ship
LovableBoltv0CursorReplitSupabaseFirebaseVercelLovableBoltv0CursorReplitSupabaseFirebaseVercel
The pattern
Builders move fast. The same holes ship every time.
AI builders reproduce a predictable set of security defects - because the underlying patterns are predictable. That's exactly what makes them findable.
- 10.3%
- of sampled Lovable apps exposed real user data through missing Row-Level Security
- CVE-2025-48757
- 98%
- of apps behind a public Supabase URL had at least one exploitable flaw
- symbioticsec.ai
- +37.6%
- more critical vulnerabilities after just five AI build iterations
- vibe-eval.com
How it works
From URL to fix in three steps
No installs, no agents, no config. If you can paste a link, you can run a scan.
- 01
Paste your URL
Point VibeSafely at any app you own or are authorized to test. No installs, no agents, no config - just the address.
- 02
We fingerprint, then probe
VibeSafely renders the app, detects the platform and backend it's built on, and runs read-only checks tuned to that exact stack - Supabase, Firebase, Vercel and more.
- 03
Get the report - and the fix
Every finding comes with a severity, the evidence we found, and a copy-paste prompt you drop straight into Cursor or Claude. Re-scan to confirm it's gone.
What we check
The flaws AI builders leave behind
Every check is remote and read-only. We don't just look for the mistake - we confirm whether it actually exposes your data.
Secrets in the bundle
We sweep every loaded script for service-role JWTs, sk_live keys, AWS credentials and API tokens that should never reach the client - and decode them to tell a real leak from a harmless public key.
Exposed sensitive files
Open .env files, committed .git directories, config dumps and stray SQL backups are one request away. We probe the common paths and flag anything that returns the real thing.
Missing & broken auth
API routes that answer without a session, GraphQL introspection left on, IDOR-shaped endpoints - we replay discovered routes read-only and flag the ones returning data they shouldn't.
Open storage buckets
Public Supabase, Firebase and S3/GCS buckets that list or hand back objects to anyone. We check the storage URLs your app already uses - read-only, never touching your files.
Headers, source maps & TLS
Missing CSP and HSTS, source maps that hand attackers your original code, weak TLS and CORS that trusts any origin. The unglamorous gaps that turn one bug into a breach.
26 checks across 7 categories
One scan covers security, SEO, AEO, accessibility, performance and uptime — every check read-only and non-destructive.
Backend & data4 checks Secrets & exposure5 checks Auth & access6 checks Headers & network3 checks Domain & email2 checks SEO & AEO2 checks Quality & uptime4 checks
The report
A scan you can act on in minutes
No vague risk scores. Every finding names the exact endpoint, the evidence we captured, and a copy-paste prompt that fixes it in your AI editor. Then re-scan to prove it's gone.
Severity, evidence and remediation on every finding Drop-in fix prompts for Cursor, Claude Code & Windsurf Structured JSON export for your pipeline
vibesafely.com/report/your-app.com
Scan complete · 27s
your-app.com
2
Critical
1
High
1
Medium
- Critical
Supabase anon key reads protected `profiles` table
GET /rest/v1/profiles?select=* → 200, 1,204 rows
- Critical
service_role JWT hardcoded in main bundle
assets/index-4f9a.js · role: service_role
- High
Source map exposes original TSX source
assets/index-4f9a.js.map · sourcesContent present
- Medium
Missing Content-Security-Policy header
GET / · no CSP on document response
Why VibeSafely
Built for the way AI builders break
Generic scanners run the same checklist on everything. VibeSafely knows the failure modes specific to AI-builder stacks - and proves them.
Active data-accessibility probing
Most scanners check that an RLS policy exists. We confirm whether your anon key can actually read protected rows - the difference between a checkbox and an answer.
Cross-stack in one pass
Supabase, Firebase, Vercel, raw REST and GraphQL - one scan, one report. No stitching together five tools that each see half the picture.
BaaS-aware by design
VibeSafely understands Supabase, Firebase and Clerk natively - so it knows when an exposed key is expected and when it's a five-alarm fire.
AI-ready fixes
Every finding ships with a remediation prompt engineered for Cursor, Claude Code and Windsurf. Paste it in, ship the fix, re-scan to confirm.
Non-destructive by design
Read-only GETs and introspection only. VibeSafely never writes, never deletes, never submits credentials. Your data is exactly as you left it.
Authorized targets only
Scope is enforced in the tool, not left to a checkbox. VibeSafely scans the host you point it at and nothing else - ethical by construction.
Pricing
Free to find. Pay to fix and keep watch.
Your first scan is free, no credit card. Upgrade when you want fixes, history and monitoring.
Free — scan any site you own and see the issues we find. Create a free account to unlock the full report. No credit card.
2 months free
Starter
€15/ mo
billed monthly
Save hours every week.
1 project 30 scans / month All 26 checks, every severity Copy-paste AI fix prompts PDF & Markdown export SEO & AEO scans 30-day finding history
Most popular
Pro
€25/ mo
billed monthly
Ship fast, stay secure.
5 projects 150 scans / month Daily monitoring All exports (PDF, DOCX, MD, JSON) Re-scan diffing & baselines Priority support
Max
€39/ mo
billed monthly
Security at scale.
50 projects Unlimited scans Custom monitoring schedules Team seats & roles White-label, branded reports API & MCP access Dedicated support
All plans run read-only, non-destructive checks against authorized targets only.
FAQ
Frequently asked questions
An app generated largely by AI builders and coding agents - Lovable, Bolt, v0, Cursor, Replit and friends. They ship working software fast, but they tend to reproduce the same handful of security mistakes because the underlying patterns are predictable.
VibeSafely fingerprints the platform first, then runs checks tuned to it. Today that covers Lovable, Bolt, v0, Cursor- and Replit-built apps, with deep support for Supabase, Firebase, Vercel and Clerk backends. Generic web checks (headers, TLS, exposed files) run on any site.
Yes, it's safe. Every check is read-only: GET requests, introspection and SELECT-style probes. VibeSafely never writes, updates or deletes data, never submits credentials, and never runs denial-of-service traffic. This is a hard design constraint, not a setting.
No. Findings are written in plain language with a severity, the evidence we found, and a step-by-step fix - including a prompt you can paste straight into your AI editor. If you can paste a URL, you can run a scan.
Only sites you own or are explicitly authorized to test. Scope is enforced in the tool, and we scan the host you provide and nothing else. Scanning without authorization is against our terms - and the law.
Generic scanners run the same checklist against everything. VibeSafely knows the failure modes specific to AI-builder stacks - and actively confirms data exposure rather than just checking whether a policy is present. That's how it catches the issues others miss without drowning you in false positives.
Your first scan is free, no credit card. Paid plans start at €15/month (Starter) for 30 scans, AI fix prompts and exports; Pro is €25/month for daily monitoring and 5 projects; Max is €39/month for unlimited scans and team features. Annual billing gives you two months free. You only upgrade once you want to fix and keep monitoring.
Find out what your AI builder left exposed.
One free scan. Sixty seconds. No credit card.