Security for apps you vibe-coded
AI tools make the first version easy. The hard part is knowing what shipped with it. VibeSitter checks the public surface and your Supabase configuration, then gives you a fix you can apply without becoming a security engineer.
What you get
- ✓Works with Lovable, Bolt, v0, and other AI-built web apps.
- ✓Free public scan, no signup and no keys.
- ✓Database-level checks through read-only Supabase OAuth.
- ✓Every finding has a plain-English fix and an AI prompt.
Checks that matter here
Leaked secrets
Finds private keys exposed in client bundles or public configuration.
Supabase RLS and grants
Checks whether public tables and policies protect user data.
Browser hardening
Reviews headers that reduce clickjacking, injection, and data leakage risk.
Cost and abuse traps
Flags settings that can turn a public endpoint into an expensive surprise.
Run a free check
Public URL only. No keys, no signup, no credit card.
Want database-level checks? See exactly what we access.
Common questions
Is this safe for my production app?
Yes. Free scans are read-only HTTP requests. Connected scans use read-only scopes and never change your project.
Do you store my code?
No. We do not clone or store your source. We inspect public responses and Supabase metadata.