Is the scan safe for my live app?

Yes. Every check is read-only. We never write, modify or delete anything on your site or database, and we never download real user records.

Do you need my code or passwords?

No. A scan needs only your URL. You never share your source code or production passwords.

Which tools do you support?

Apps built with Lovable, Bolt, Replit, Cursor, v0, Claude Code and Windsurf, plus anything on Vercel or Netlify or using Supabase or Firebase.

Do you check SEO, AEO and GEO too?

Yes, on every plan. Each scan gives three scores next to your security score. SEO covers what Google and Bing need: robots.txt, noindex, canonical URL, sitemap, titles, descriptions, broken pages and link previews. AEO (answer engine optimisation) covers what featured snippets and voice answers draw on: structured data, subheadings and questions answered on the page. GEO (generative engine optimisation) covers what AI assistants such as ChatGPT, Perplexity and Claude need: whether robots.txt lets their crawlers in, whether your pages have content before JavaScript runs, and whether your structured data says who runs the site. Each issue comes with a fix, written for your stack when we can tell it is Lovable, Vite or Next.js. The dashboard also has free SEO tools, such as a search result preview and a schema markup generator.

How much will it cost?

The Free plan covers one site and four scans a month, at no cost. Paid plans start at $9 a month, or ₹499 a month in India. Prices are shown for the country you visit from.

For apps built with AI

Find the vulnerabilities in your AI-built app before hackers do.

Paste your link. We look for exposed keys, open databases and risky settings in your Lovable, Bolt or Cursor app, then hand you fix prompts to paste into your AI tool.

Read-only checks
No code access needed
Free plan, no card

See a real sample report

Example scan / demo-shop.app

→ Loading app… found 14 JS files

→ Detected: Lovable + Supabase

✗ CRITICALDatabase table `orders` readable without login

✗ HIGHOpenAI API key exposed in main.js

! MEDIUMMissing Content-Security-Policy header

✓ PASSHTTPS configured correctly

Teams that scan their live apps with TheVibeSecurity

Built to scan apps made with

Lovable
Replit
v0
Claude
OpenAI
GitHub
Firebase
Netlify
Cloudflare
Clerk

Bolt
Cursor
Windsurf
Gemini
GitHub Copilot
Supabase
Vercel
Next.js
Stripe
Expo

Logos belong to their owners. No affiliation or endorsement implied.

See it in action

30 seconds, one link, real findings.

Scan

Why TheVibeSecurity

We check the doors AI tools leave open.

Database rules, API keys and open routes, seen the way an outsider sees them.

Read-only

Checks only look. Nothing on your site is written or deleted.

First report free

Your first surface scan is free.

Link to fix

Ranked findings and a ready prompt for your AI tool.

Try it

Watch a sample scan.

Pick an example app and run the demo. It uses sample data only; nothing is being scanned.

demo-shop.appLovable + Supabase

Loading the app
Detecting the stack
Probing database rules
Reading JavaScript for keys
Checking headers

–

Security score

Run the demo to see findings

Demo on sample data. Jump to a real report

Scan your own app

Sample report

See exactly what you get.

A real scan of our own deliberately insecure demo shop. Every key, customer and file in it is fake, but the findings and fix advice are exactly what your report will look like.

thevibesecurity.com/r/…Open

Demo site built to be insecure. Nothing in this report is a real leak.

Scan your own app

For builders

Built for people who ship with AI.
The report is just the start.

Wire TheVibeSecurity into the way you already build.

A fix prompt for the tool you use

Every finding comes with a ready-made prompt, worded for how each AI tool works. Paste it, ship the fix, rescan to confirm.

Paste into the Lovable chat

My Supabase table `orders` is readable without login. Enable Row Level Security on `orders`, remove any policy that allows the anon role, and add a policy so signed-in users can only read rows where user_id = auth.uid(). Show me the SQL and apply it. Do not touch other tables.

What your AI tool writes back

  -- supabase/migrations/…_secure_orders.sql
+ alter table orders enable row level security;
+ create policy "own rows" on orders
+   for select using (auth.uid() = user_id);

Illustrative prompt and result for an open database finding.

Fix it, then watch the score move

Mark a finding fixed and rescan. Your score climbs with every fix. Try it on this sample.

criticalDatabase table readable without login
highOpenAI key exposed in main.js
mediumMissing Content-Security-Policy

Demo on sample data.

Prove it's yours, then go deep

Verified scan

Deep database and route checks unlock only after you verify ownership, by whichever method is easiest for your stack.

Type    TXT
Host    _vibesecurity
Value   vibesecurity-verify=8f3a…c91d

Illustrative token.

A badge for your site

Drop a “Secured by” badge in your footer or README. It updates on its own and only says Secured while your verified site scores 85+ with no high or critical issues.

Secured by TheVibeSecurity

Reports you can share

Send clients and investors a read-only report link, or save it as a PDF from your browser. Secrets and file paths are never included.

thevibesecurity.com/r/…

Save as PDF

Who it's for

Built for the way you build.

Ship without the 3 a.m. worry.

Catch open databases and leaked keys before your users do.
Paste a ready fix prompt straight into Lovable or Cursor.
Rescan after every release to confirm nothing regressed.

Builder plan

The research

The numbers, in case you want them.

Independent research on AI-generated code. Every figure links to its source.

of solutions from one leading coding agent were secure in the SusVibes benchmark, even though 61% worked.

SusVibes, arXiv 2512.03262

of tests produced code with a security flaw, across 100+ large language models.

Veracode GenAI Code Security Report

CVEs confirmed as linked to AI-generated code through March 2026, the last published count.

Georgia Tech Vibe Security Radar, cited in a Cloud Security Alliance research note (April 2026)

Where AI tools commonly slip up

Coverage

What we scan for

Every check is read-only. Deeper database and route checks run only after you verify that you own the site. Every scan also scores how well search engines, answer engines and AI assistants can read your site.

Secrets and files

API keys in JavaScript
Exposed .env and .git
Source maps

Database and storage

Verified scan

Supabase RLS
Firebase rules
Public buckets

Routes and APIs

Verified scan

Admin routes
API routes

Configuration

Security headers
HTTPS
CORS
Cookies

Dependencies

Outdated libraries with known CVEs

SEO, AEO and GEO

Google and Bing indexing
Link previews
Answer-ready content
Structured data
AI crawler access
Pages empty without JavaScript

Quick self-check

Is your app at risk?

Six questions, thirty seconds. This is a self-check, not a scan.

01Did an AI tool write most of your backend?
02Does your frontend talk to Supabase or Firebase directly?
03Have you ever pasted an API key into frontend code?
04Did you set and test database rules (like RLS) yourself?
05Do any admin pages or API routes skip a login check?
06Have you added security headers such as CSP?

Your result

0 / 6 answered

Answer all six to see where your app likely stands.

Lower risk
Worth checking
Likely exposed

Start now

How it works

From link to fix in three steps.

01
Add your link
Sign in with Google or email and paste your app's URL. No code access, no passwords.
02
See what's exposed
Issues ranked Critical to Low, each explained in plain English.
03
Paste the fix prompt
Copy a ready-made prompt into Lovable, Cursor or Claude Code. Rescan to confirm.

Pricing

Costs less than one leaked API key.

Start free and see what’s exposed today. Upgrade when you run more apps or want your database checked and scans to run on their own.

How many sites?3→ …

Pay by card in US dollars
Free plan needs no card
One-time payment, nothing renews automatically
Scans are read-only and never change your site

Finding the right prices for your country…

Questions

Straight answers before you paste a link.

What the scan does, what it never touches and what it costs.

TheVibeSecurity is a web-based security scanner for apps built with AI coding tools such as Lovable, Bolt, Cursor, Replit and v0. You paste your app's URL and it checks, read-only, for exposed API keys, open Supabase or Firebase databases, exposed .env and .git files, missing security headers and unprotected admin routes, then gives you a fix prompt to paste back into your AI tool. Every scan also scores the site for SEO, AEO and GEO. The first plan is free and needs no card.

Read before you ship.

Source-backed guides on the mistakes AI-built apps make most, and how to test your own.

Fundamentals

Is My Lovable App Secure? A 15-Minute Self-Check

Is my Lovable app secure? A 15-minute self-check covering Lovable's security scan, Supabase RLS, storage buckets, keys and secrets, no developer needed.

22 Sep 2026 · 11 min readRead →

Incidents and lessons