This is the shape of a VibeVigil report. The site, keys, and tables are fictional. A live scan of your URL uses the same page, with your findings and your fix prompts.
2
Example score
criticalsecret
Supabase service role key is in client-side code
The service role key bypasses Row Level Security. Anyone who loads the site can copy it. This sample does not contain a real key. A live scan stores only a masked preview.
Masked preview eyJhbG…9f3a. Full key was not stored. Found in https://notes.example/assets/index.js.
Fix prompt
You are fixing a security issue in this web app. VibeVigil found it with a passive, read-only scan of the public site. Do not exploit anything. Do not print secret values.
Supabase service_role key is shipped in client-side JavaScript at https://notes.example/assets/index.js.
Do this:
1. Remove the service role key from client files and from any NEXT_PUBLIC_ or VITE_ variable.
2. Rotate the key in the Supabase dashboard. Assume the old one is public.
3. Use the anon key in the browser. Do privileged work in a server route with a server-only env var.
Constraints:
- Do not print secret values in logs, commits, test output, or your reply.
- Do not disable Row Level Security, authentication, or security headers to make a check pass.
- Do not add the secret to a NEXT_PUBLIC_, VITE_, or other client-exposed variable.
- When you finish, list the files you changed and what you rotated.
criticalrls
Supabase table "profiles" is readable without a user
The anon key received at least one row from profiles. Anyone who can load the site can read it the same way. Row contents are not part of this report.
Table profiles returned rows to the anon key. Rows were not stored.
Fix prompt
You are fixing a security issue in this web app. VibeVigil found it with a passive, read-only scan of the public site. Do not exploit anything. Do not print secret values.
The Supabase table "profiles" returned rows to the anon key.
Do this:
1. Enable row level security on "profiles" if it is off.
2. Add a policy so people can only read their own row. Do not add a broad policy for the anon role.
3. Re-test with the anon key and confirm another user's row does not come back.
Constraints:
- Do not print secret values in logs, commits, test output, or your reply.
- Do not disable Row Level Security, authentication, or security headers to make a check pass.
- Do not add the secret to a NEXT_PUBLIC_, VITE_, or other client-exposed variable.
- When you finish, list the files you changed and what you rotated.
criticalfile
/.env is publicly readable
A file that looks like environment variables answered on the public site. The values are not included here.
GET /.env returned plain text that looks like KEY=value lines. Values were not stored.
Fix prompt
You are fixing a security issue in this web app. VibeVigil found it with a passive, read-only scan of the public site. Do not exploit anything. Do not print secret values.
/.env is publicly downloadable from the deployed site.
Do this:
1. Remove the env file from the published folder.
2. Rotate every credential that was in it.
3. Keep secrets in the host's environment settings.
Constraints:
- Do not print secret values in logs, commits, test output, or your reply.
- Do not disable Row Level Security, authentication, or security headers to make a check pass.
- Do not add the secret to a NEXT_PUBLIC_, VITE_, or other client-exposed variable.
- When you finish, list the files you changed and what you rotated.
mediumheader
Content-Security-Policy header is missing
Without a content security policy, an injection bug can load a script from anywhere. Add a policy that matches how the app actually loads its bundles.
The homepage response did not include Content-Security-Policy.
Fix prompt
You are fixing a security issue in this web app. VibeVigil found it with a passive, read-only scan of the public site. Do not exploit anything. Do not print secret values.
Content-Security-Policy header is missing.
Do this:
1. Add the header on HTML responses.
2. Start with the other security headers if you are unsure of a policy that will not break the app.
3. Then add a CSP that allows only the origins this app uses.
Constraints:
- Do not print secret values in logs, commits, test output, or your reply.
- Do not disable Row Level Security, authentication, or security headers to make a check pass.
- Do not add the secret to a NEXT_PUBLIC_, VITE_, or other client-exposed variable.
- When you finish, list the files you changed and what you rotated.
hightls
TLS certificate expires within 14 days
The certificate is still valid and expires soon. Renew it before browsers start warning visitors.
About 9 days remaining.
Fix prompt
You are fixing a security issue in this web app. VibeVigil found it with a passive, read-only scan of the public site. Do not exploit anything. Do not print secret values.
The TLS certificate expires in under 14 days.
Do this:
1. Renew it from the host's domain settings.
2. Confirm automatic renewal is actually succeeding.
Constraints:
- Do not print secret values in logs, commits, test output, or your reply.
- Do not disable Row Level Security, authentication, or security headers to make a check pass.
- Do not add the secret to a NEXT_PUBLIC_, VITE_, or other client-exposed variable.
- When you finish, list the files you changed and what you rotated.
This page is a picture. Your scan is the real one.
Paste your URL. You see the report before you make an account.
VibeVigil