VibeVigilBlog · October 21, 2026
What a free scan checks
The free scan reads the public page only. Here is the short list. No account is required.
You can scan a site you own with no account. The report comes first. You can make an account later if you want the site watched.
The scan does not guess passwords. It does not try to break in.
It opens the home page. It reads the JavaScript that page loads. It looks for secret keys that should stay on a server. A Supabase anon key is normal. A service role key is not.
If it finds a Supabase project and an anon key, it checks which tables a stranger can read. It keeps the table names. It does not keep the rows.
It also checks HTTPS, a few security headers, and whether files like .env or .git are public. It notes how fast the page answered.
Each problem has a short fix note. You can paste that note into Cursor, Lovable, or Claude.
Daily scans start only after you pay for a plan at checkout. The free scan does not ask for a card.
A short note. Not a promise.
If you want to know about your own site, run the free scan.
Scan a site you own. It is free. No account.
You see the report first. Saving the site is optional.