VibeCheck — Launch checks for vibe-coded apps

The AI wrote the code. Who checked it?

Vibe coding gets you to "it works on my machine" fast. The boss fight starts after you hit deploy.

🔑

Keys in the open

An API key committed "just for testing" is now public, and someone else is running up your bill.

🗄️

Databases with the door open

Missing row-level security means any visitor can read (or delete) every user's data.

💥

Silent crashes

No error handling, broken env vars, a deploy that fails at 2am. You find out from an angry DM.

Three steps. Zero lectures.

STEP 01

Paste a link

Drop in a GitHub repo or your live site URL. That's the whole setup.

STEP 02

The agent scans

It combs through your code and app for secrets, security holes and deploy problems.

STEP 03

Get your fix list

A plain-English report lands in your inbox, ranked by severity, with copy-paste fixes.

What we check

leaked_secrets

API keys, tokens and credentials in code, commit history or client-side bundles.

exposed_databases

Supabase/Firebase rules, missing row-level security, public storage buckets.

broken_auth

Unprotected routes, admin pages anyone can reach, auth checked only in the frontend.

error_handling

Unhandled promises, stack traces leaking to users, API calls with no fallback.

deploy_issues

Missing env vars, debug mode left on, misconfigured CORS, broken builds.

basics

HTTPS, security headers, outdated dependencies with known vulnerabilities.

Here's what lands in your inbox

Sample report. Example data only, not from a real project.

vibecheck-report · example-app (EXAMPLE)

Vibe score: C+ · 2 critical · 1 warning · 1 nice-to-have

[CRITICAL] OpenAI key exposed in client bundle

src/lib/ai.ts:4 ships your secret key to every visitor's browser.

# Fix: move the call to a server route

// app/api/chat/route.ts
const key = process.env.OPENAI_API_KEY; // server only

[CRITICAL] Row-level security disabled on "profiles"

Anyone with your anon key can read every profile.

alter table profiles enable row level security;
create policy "own row" on profiles
  for select using (auth.uid() = id);

[WARN] /admin reachable without login

Auth is only checked in the React component. Add a server-side check.

[INFO] Missing Content-Security-Policy header

Pick your difficulty

EASY MODE

Mini-scan

✓ Top-level scan of one repo or URL
✓ Critical issues flagged
✓ Emailed summary

Run free check

RECOMMENDED

NORMAL MODE

Full Report

$19 one-time

✓ Every check, every severity
✓ Copy-paste fixes for each issue
✓ Plain-English explanations
✓ One re-scan after you fix

Get full report

HARDCORE MODE

Always On

$9 /month

✓ Re-scan on every push
✓ Alerts when something new breaks
✓ Full reports included
✓ Cancel anytime

Go Always On

FAQ

Do I need to be a "real" developer?

Nope. Reports are written in plain English, and every fix is something you can paste straight into your code or your AI editor.

Which tools does it work with?

Anything that ends up as a GitHub repo or a live URL: Cursor, Replit, Lovable, Bolt, v0, Windsurf, or hand-written code.

Can you scan private repos?

Private repo support via read-only GitHub access is planned. Public repos and live URLs come first.

Do you store my code?

We only read what's needed to run the scan, and we don't keep your source after the report goes out.

Is this a replacement for a security audit?

No. It catches the common, costly mistakes fast and cheap. If you handle payments or sensitive data at scale, get a professional audit too.

Can I cancel Always On?

Anytime, in one click. No retention boss fight.

You vibed it.
Now check it before you ship it.