Is your vibe-coded app
safe to ship?
Paste a public GitHub repo. Get a plain-English health report: leaked keys, open Supabase tables, unauthenticated API routes, vulnerable packages, and a launch-readiness score out of 100. Every issue comes with a fix.
Early access: we'll email your report when your spot opens. Not an instant scan yet.
01 How it works
Paste your repo
Drop in a public GitHub URL. No signup, no write access.
We run the checks
Secrets, Supabase RLS & policies, API route auth, npm advisories, launch basics.
Get your score + fixes
A score out of 100, issues ranked by severity, and a copy-paste fix for each one.
02 A real report, anonymized
From a real open-source Next.js + Supabase storefront we scanned. Names removed; findings unchanged.
13 npm packages with known vulnerabilities
Why it matters: Includes a critical Next.js advisory (image optimization cache-key confusion).
→ Run npm audit fix, then bump Next.js to the latest patch release and re-test.
Supabase tables without Row Level Security (2)
Why it matters: Anyone holding your public anon key (it ships in your frontend) can read or change these tables.
→ alter table <name> enable row level security; then add policies like using (auth.uid() = user_id).
Supabase policies that allow everyone — using (true)
Why it matters: A true policy on write actions means any visitor can insert/update/delete.
→ Replace true with a real condition, especially on insert/update/delete policies.
No lockfile committed
Why it matters: Without a lockfile, every fresh install can pull different package versions, so your app may break on deploy.
→ Run npm install and commit the generated package-lock.json.
API routes with no visible auth check (8 of 12)
Why it matters: Routes like /api/checkout and /api/upload can be called directly, bypassing your UI.
→ Get the current user at the top of each handler and return 401 if missing.
03 Pricing
Waitlist scan
- Public GitHub repos
- Score out of 100 and top issues
- Emailed when early-access spots open
Full Report
- One public GitHub repo
- Every finding with a plain-English fix
- HTML report emailed to you
- Full refund if the scan fails
Public repos only; private repos aren't supported yet. Reports are produced by an automated queue and emailed, usually within minutes, not shown instantly. Refund policy.
Auto-Fix
- Agents open a pull request with the fixes
- Private repos
- Re-scan on every push
04 FAQ
What is a “vibe-coded” app?
An app built mostly by prompting AI tools (Cursor, Lovable, Bolt, v0, Claude, etc.). They ship fast, but often with open database tables, leaked keys and unprotected API routes.
What do you check?
Leaked secrets and API keys, Supabase tables without RLS or with wide-open policies, API routes without auth checks, known-vulnerable dependencies, type errors and other breakage risks, plus launch-readiness basics.
Do you need access to my code?
The free scan works on public GitHub repos: you paste the URL, we read the code. No login and no write access. Private repos come later via a GitHub app with read-only scope.
Is it available now?
We’re onboarding early-access users from the waitlist. Drop your repo and email and we’ll send your report when your spot opens. Scans aren’t instant from this page yet.
Will you fix the issues for me?
Every finding comes with a plain-English fix you can paste into your AI tool. A paid Auto-Fix tier, where agents open a pull request with the fixes, is coming soon.
Can you scan private repos?
Not yet. The $19 Full Report works on public GitHub repos only. Please don’t buy a report for a private repo; if you do by mistake, the scan will fail and you’ll be refunded.
Is a good score a security guarantee?
No. VibeCheck catches common, high-impact mistakes automatically. It’s not a replacement for a professional audit on apps handling sensitive data.
Ship it. But check the vibes first.
Join the waitlist for early-access scans and the Auto-Fix launch.