Know if your vibe-coded app is leaking — before strangers do.
VibeScanHQ is a read-only security radar for apps shipped with Lovable, Bolt, Cursor, and friends. Paste a URL. Get a report. Fix with copy-paste prompts. Re-scan on a schedule.
Leaked secrets
Stripe live keys, OpenAI, Anthropic, AWS, GitHub tokens, Supabase service_role JWTs — redacted in the report.
Open data
Supabase tables readable by anon, public storage buckets, open Firebase rules, exposed .env and .git.
Fix prompts
Every finding includes a prompt you can paste into Lovable, Cursor, or Bolt. Pro unlocks the full list.