VIBE CODE SCANNER

What is a vibe code scanner?

A vibe code scanner is an automated security tool that probes a live AI-generated web app for the specific failure modes that AI coding tools tend to ship: exposed API keys in the browser bundle, missing Row Level Security on Supabase and Firebase tables, admin routes without auth checks, and open storage buckets. It runs against your deployed URL, no source code required, and returns findings in under two minutes.

This scanner covers apps built with Lovable, Bolt.new, Cursor, Claude Code, v0, Replit, Base44, Figma Make, and Windsurf — the full family of AI-generated-app tools — and everything they typically deploy onto (Vercel, Netlify, Railway, Render, Fly.io).

The vibe-coded app security checklist

AI coding tools have a family of recurring gaps. This scanner tests all of them in one pass:

• Missing Row Level Security on Supabase or Firebase tables
• Exposed API keys in the frontend bundle (Stripe secret, Firebase service account, OpenAI, Anthropic, AWS)
• Auth flows that check the user but skip role or permission checks
• CORS set to * on endpoints that return sensitive data
• Debug routes and admin panels that shipped to production
• Public storage buckets with no ACL
• Inline scripts that force an unsafe Content Security Policy
• Webhooks with no signature verification
• eval() or remote-code execution of user input

What the scanner detects

How to use

1. Paste the URL of your deployed app into the scanner at the top of this page.
2. Wait ~2 minutes — the scanner loads the app, captures every request, and probes common attack surfaces.
3. Review findings by severity: Critical, High, Medium, Low. Each includes evidence (which URL, header, or bundle triggered the detection).
4. Copy the fix prompt into Claude Code, Cursor, or Lovable to patch the issue.
5. Rescan to confirm the fix before you ship.

Which AI coding tools have the most common issues?

Related tools and guides

• Token Leak Checker — focused scan for exposed API keys in the frontend bundle.
• Firebase Scanner — Firestore Security Rules, auth, and storage bucket checks.
• Supabase RLS Checker — verify every table has a correct Row Level Security policy.
• Lovable Safety Guide — what Lovable ships insecure by default and how to fix it.
• Is Replit Safe? — public repls, Secrets in forks, and AI-generated endpoints without auth.
• Is Netlify Safe? — build-log leaks, redirect rules, and Functions audit.
• Cursor Security Risks — full Cursor risk profile and hardening checklist.
• Firebase Security Rules: 12 Common Mistakes — rule snippets that fix each mistake.
• Best Burp Suite Alternatives — 9 alternatives compared on features, price, and learning curve.
• Best SAST Tools for AI-Generated Code — Snyk vs Semgrep vs Checkmarx vs VibeEval.
• OWASP Top 10 for AI Code — the canonical failure modes for AI-generated apps.
• Vibe Hacking — how attackers probe vibe-coded apps, so you can think like one.