Free vibe code check

Is your AI-built app safe to launch?

Built with Lovable, Bolt, Replit or Cursor? Enter your URL. In about a minute we check for exposed secret keys, public source code, database setup, pages Google can't read, speed and security headers.

No account required. We keep your website data and email completely private.

What the check looks for

The mistakes AI builders make most often, checked from the outside, the same way an attacker or Google would see your site.

Secret keys in your code

OpenAI, Anthropic, Stripe, Supabase service keys and more, sitting in the JavaScript every visitor downloads.

Database exposed to the browser

Whether your app talks to Supabase straight from the browser, where row-level security is the only thing protecting your data.

Public source code

Source map files that let anyone download your original, readable code.

Invisible to Google

Pages that are blank until JavaScript runs, plus missing titles, descriptions and sitemaps.

Speed on real phones

Google PageSpeed scores and load times, mobile and desktop.

Security headers and HTTPS

The basic browser protections most AI builders leave switched off.

This scan only sees what is public. It cannot read your database rules, server code or login logic. Our Security & SEO Audit reviews those by hand, from $497.

See fix prices