Your app works.
Is it leaking?
Paste your app link or GitHub repo. VibePatrol checks it the way a stranger would and tells you, in plain words, what's exposed. Fix prompts paste straight into your AI builder.
How it works
📋
Paste a link
Your live app, or a public GitHub repo. Confirm it's yours.
🔍
We look around
Only what any visitor (or anyone reading your repo) could see. Nothing gets changed.
🩹
Paste the fix
Free score + risk counts. Unlock the full report and a fix prompt for each problem.
🔑
Leaked keys
Stripe, OpenAI, Anthropic, AWS, GitHub, Supabase service_role in your JS.
📄
Open files
.env, .git, backups and lockfiles left on the web server.
🗄️
Open tables
Supabase tables anyone can read (owner opt-in).
🧩
Old versions
Next.js, NGINX, PHP and WordPress plugins with known CVEs.
🛠️
Dev servers
next dev / Vite / debug pages running in production.
🧱
Headers
HSTS, CSP, framing and CORS. The boring stuff that matters.
Recent ones we look for: Next.js 16.4.1 RCE fixes, the Bricksforge WordPress exploit, the tensorlake npm worm. Read the news →
AI moves fast.
Attackers move faster.
The same AI that builds your app in an afternoon also helps people break apps. Work that used to need a team of skilled hackers, like reading minified JavaScript, spotting a leaked key or testing whether a database is open, can now be done by a teenager with no coding background and a frontier AI model.
That's not a reason to panic. Most leaks come from a handful of well-known mistakes, and they're quick to fix once you can see them. That's the whole job of VibePatrol.
We keep adding checks as new vulnerabilities are published. See what's new →
- Before: finding a leaked key took skill and time.
Now: paste a page's source into a chatbot and ask. - Before: new sites went unnoticed for a while.
Now: bots watch new domains and scan them within hours. - Before: one bug, one victim.
Now: the same AI-generated mistake ships in thousands of apps.
What researchers are finding
Real public posts on X. Quotes are exact excerpts; click through for full context.
Wiz Research @wiz_io · 2026-02-02
“By examining client-side JavaScript on Moltbook's website, we found a Supabase API key with no Row Level Security in place.”
View on X →
Wiz Research @wiz_io · 2026-02-02
“Wiz Research uncovers an exposed @moltbook database leaking 1.5M API keys, private agent-to-agent DMs, and full write access to all platform content”
View on X →
Wiz Research @wiz_io · 2025-07-29
“We found a critical vulnerability in the popular Vibe Coding Platform @base44: No password. No invite. Full access.”
View on X →
Gergely Orosz @GergelyOrosz · 2025-06-03
“My vibe-coded “what is vibe coding app” is great reminder why “vibe coded” apps on platforms like Lovable are great for prototyping but not for production.”
View on X →
Simon Willison @simonw · 2025-03-24
“it's irresponsible to ship "vibe coded" products if security flaws in them could cause real harm to people.”
View on X →
Pieter Levels @levelsio · 2025-05-11
“Great opportunity for a product: Security testing for vibe coded apps”
View on X →
Pricing
Check for free. Pay once if you want the fixes. No subscription.
$0
- ✔ Score out of 100
- ✔ Risk breakdown + top problem (with email)
- ✔ Live app or public repo
$9
one time, one report
- ✔ Every problem, in plain words
- ✔ AI fix prompt for each
- ✔ Private link + passcode
$29
10 reports · $2.90 each
- ✔ 10 unlock credits, never expire
- ✔ Re-check after each fix
- ✔ Dashboard with all reports
Payments by Stripe. Weekly monitoring plans are coming back later.
FAQ
What's free?
The scan and your score. Add your email to see the risk breakdown and the top problem. The full list with a fix prompt for every problem is a one-time $9.
Is this a subscription?
No. Pay once per report ($9) and get a private link plus a passcode by email, or grab a 10-report pack ($29) with a dashboard that lists all your reports.
What does a report look like?
See the sample report at /sample. It uses a fake app and a fake, redacted key.
Do you attack my site?
No. Ordinary GET/HEAD requests only (about 40 per scan), no exploit payloads, no logins, no forms. Any secret we spot is masked.
What about my repo?
Paste a public GitHub link. We download the code once, look for committed keys, .env files, vulnerable packages (OSV.dev) and tables without RLS in your Supabase migrations, then throw the code away. Private repos via GitHub sign-in are next.
Can I scan someone else's app?
Only with permission. You confirm it every time.
Does a good score mean I'm unhackable?
No tool can promise that. We catch the most common, most expensive mistakes first.