Free security scan for vibe-coded apps. Find leaked API keys, exposed .env files and risky Supabase setups, then get copy-paste fix prompts for your AI builder. Fix it and prove it.
OpenAI, Anthropic, Stripe, AWS, GitHub and more in your HTML and JS bundles, plus Supabase service_role keys that bypass all security.
Is your /.env or /.git folder downloadable by anyone?
Detects Supabase and Firebase so you know what to lock down. Live RLS testing comes after ownership verification.
CSP, HSTS, clickjacking, nosniff, referrer policy, CORS and source maps.
Lovable projects found with exposed data in one 2025 scan (CVE-2025-48757).
secrets exposed across 5,600 vibe-coded apps (Escape.tech).
of AI-generated code samples had security flaws (Veracode).
Grade and issue counts in seconds.
Plain-English fixes and prompts written for your AI builder.
Re-scan to confirm each fix, and earn a "Latched" badge to show your users.