Skip to content

Free scan

Your AI-built app is public. A secret key might be too.

You built it with Lovable, Bolt, v0, Cursor, or Replit. People can open the site. VibeVigil reads the public page and the JavaScript. It tells you what is wrong in short words. It gives you a note to paste into your coding tool.

Scan your site free

No account. You see the report first. You must own the site.

Scan report for example.com on October 23, 2026. Score 75. Two missing security headers.

Scan a site you own

The check is read-only. No password guessing. No exploit.

Scan a site you own. It is free. No account.

You see the report first. Saving the site is optional.

No account. The report is the next page.

Free, no account. We fetch the public page, its scripts, and a few well-known paths.

What a scan looks at

Every check is a normal page read.

Secret keys in JavaScript
Service role keys, Stripe and OpenAI secrets, AWS and GitHub tokens. The anon key is fine. The service role key is not.
Supabase tables anyone can read
If we find a project URL and an anon key, we try a read-only select. We keep table names only.
Security headers
Content-Security-Policy, HSTS, framing protection, nosniff, and Referrer-Policy.
The HTTPS certificate
We check that it is trusted, which version it uses, and if it is close to expiring.
Files that should be private
We request /.env, /.git/config, and source maps. A home page returned for every path is not a leak.
Is the page up?
Did the home page answer, and how long did it take?

A fix note, not a pile of codes

Each finding says what is wrong. Then it gives you a note for Cursor, Lovable, or Claude. Paste it in. Read it before you apply it.

  1. 1

    Add the URL

    You say you own the site. We scan it once.

  2. 2

    Read the report

    Short notes. No raw key. No database row.

  3. 3

    Paste the note

    Your coding agent makes the change. You deploy.

  4. 4

    Get the Monday email

    Paid plans scan every day and email you on Monday.

Pricing

Paid plans are charged up front at Stripe Checkout, before daily scans start. Stripe then bills the same monthly price. There are no surprise charges and no extra scan fees. You can cancel in the billing portal.

Free
One site. Scan it when you want. No card.

$0/mo

  • 1 site
  • You run the scan
  • 1 scan a day
  • Plain words and a fix note
Scan a site free
Pro
Three sites. We scan them every day.

$19/mo

  • 3 sites
  • Daily scans
  • 10 manual scans a day
  • Monday email
  • Email when a new high issue shows up
Pay $19 at checkout
Team
Fifteen sites on one login.

$49/mo

  • 15 sites
  • Daily scans
  • 30 manual scans a day
  • Monday email
  • High-issue alerts
  • One login. No shared seats yet
Pay $49 at checkout

Questions

VibeVigil — Watch apps you built with AI tools