Menu

Free tool

Probe your deployed app like an attacker

Enter the public URL of an app you shipped with Lovable, Bolt, v0, Cursor, or similar. We fingerprint the stack, hunt secrets, map APIs and tables, score risk from 0 to 100, and show the top fixes first. Read only. We never ask you to paste code or secrets.

Scans run on a Cloudflare Worker so we can reach the site the way a stranger would. Free limit: 5 scans per 10 minutes per network. Anonymous scans are GET, HEAD, and OPTIONS only (plus read-only Supabase or Firebase probes). We never write to your app.

Prove ownership for deeper read-only checks (optional)

Deeper checks stay read-oriented. We do not create throwaway auth users on free scans because we cannot reliably delete them without an admin key.

Deeper checks only apply in the browser that verified. Verifying gives this browser a private owner key, kept in local storage. Anyone else who scans your site gets the normal anonymous scan. You can re-verify any time with a new token, which replaces the old key.

Looking for keys in a GitHub repo instead? Use the repo scanner.

What it checks

  • Stack and client library fingerprint with a curated free CVE pack (including CVE-2025-29927), Firebase path probes, OpenAPI GET expansion, Appwrite/PocketBase/Hasura/Convex, Fix now playbooks, Serious vs Hardening tips, and a README score badge
  • Auth surface map, open-redirect probes, GraphQL introspection checks, and nested Supabase selects (read only)
  • Risk score 0-100, peer comparison by stack (anonymous buckets only), TLS expiry and HTTPS redirect notes
  • Export Markdown report, copy a shareable summary, and one-click copy a README badge snippet; scan again anytime to see what improved

Ownership

Optional: prove you control the host with a file at /.well-known/vibelocked-verify.txt or a DNS TXT record on _vibelocked-verify. Until then we only run anonymous reads. After proof we add deeper read-only checks (still no mutating RPCs or throwaway signups).

The data behind it

We ran these same read-only checks against 2,511 live vibe-coded apps on nine platforms. About one in five Supabase apps left a database table open to anyone. Read the study.

Limits

This is an outside read of a public URL. A clean result is not a guarantee. Cap: about 20 same-origin scripts, about 1.5 MB each, short timeouts, capped probe counts.

Related: exposed .env, .git, and source maps, anon vs service role, CORS misconfiguration, CSP for vibe-coded apps.