Vibe-Code Leak Check

Paste a URL to find leaked keys and open tables in AI-built apps

Problem

Apps built with Lovable, Bolt and Cursor often ship with Stripe keys or cloud tokens in frontend code, or leave Supabase tables publicly readable, and makers never notice. Existing security tools target professional teams; non-technical indie developers do not know how to configure them.

Solution

Users paste a public URL; the tool reads the page and JS bundles like a browser, detects live keys, private keys and cloud credentials, and probes whether Supabase-style tables allow anonymous read or write. It returns a visual risk report with step-by-step fixes and supports re-checks.

Users

Non-security indie developers and small teams shipping fast with AI tools

MVP

URL fetch and JS static scan; known key pattern matching for Stripe, cloud providers and private keys; Supabase anonymous access probe; risk report with fix checklist; re-check comparison

Revenue

Free single report; subscription for continuous monitoring and history; white-label reports for agencies

Why now

Vibe coding has put apps from non-security people into production at scale, expanding the leak surface, while general scanners lack explainable reports for this audience