Ship your vibe-coded app without fear.

VibeSentry checks your app the way a hacker would — exposed keys, leaking databases, admin panels without login — in 60 seconds. Paste your URL. No signup.

Passive checks only · we never log in · ≤ 25 requests · no signup, no credit card

98%

of scanned Supabase-backed apps had security flaws

SymbioticSec, 1,072 apps

1 in 9

indie apps leaked their database keys

SupaExplorer, 20,000 apps

380,000

vibe-coded apps publicly exposed

RedAccess, 2026

What we check

16 passive checks, run from the outside. Everything a leaked key or open database needs to become tomorrow's incident report.

Exposed secrets

✓ OpenAI / Anthropic / AWS / Stripe / GitHub keys in shipped code
✓ Supabase service_role keys (full database bypass)
✓ High-entropy tokens that may be undocumented keys

Leaky endpoints

✓ .env and .git directories open to the world
✓ Admin panels reachable without login
✓ Production source maps exposing your code

Transport & headers

✓ HTTPS enforcement, HSTS, TLS expiry
✓ CSP & clickjacking protection
✓ Session cookie flags (Secure / HttpOnly / SameSite)

Plain-English fixes

✓ Every finding explains what to do
✓ Copy-paste fix prompts for Lovable / v0 / Bolt
✓ Speaks your stack: Lovable, Supabase, Next.js detected

CRITICALAdmin console reachable without login

GET /admin returned 200 — “Admin console — Challenge Brew”

Fix: Add Supabase Auth middleware to /admin, or move it to a non-guessable internal URL.

Real finding from a public Lovable showcase app, 2026-09-07.

How it works

Paste your URL

60 seconds, no signup, no repo access. We look at your app exactly like a visitor — or an attacker — would.

Get your report

Severity-ranked findings with evidence: what we saw, where, and why it matters.

Fix with confidence

Each finding ships a fix you can paste straight into Lovable or v0. No security degree required.

Pricing

A manual pentest costs $900+ per engagement. Your first scan is free, forever.

Free

One-off scans

✓ Unlimited one-off scans
✓ Shareable report pages
✓ 16 passive checks

Solo

Studio

$79/mo

Watch a portfolio

✓ 5 apps
✓ Slack / Discord alerts
✓ Screenshot diffs per deploy
✓ Priority support

FAQ

Do you need my code or GitHub access?

No. VibeSentry runs passive checks from the outside, just like a browser visit. Nothing to install, nothing to connect.

Is it safe to scan my site?

We only fetch public pages (≤25 requests), never log in, and never attempt exploitation. Probing deeper requires verifying that you own the site.

What about Supabase Row Level Security?

We detect your Supabase anon key and flag tables at risk. A deep database check (after ownership verification) is launching next — join the list below.

Will you catch things my platform already warns me about?

Sometimes — but platforms only guard their own garden. VibeSentry is stack-agnostic and independent: it checks the app you actually shipped, however you built it.