We look at your app the way a stranger would β and tell you, in plain words, what they can see that they shouldn't. Secret keys sitting in public code, open customer data, missing Google basics. Fixed in minutes, not days.
Free Β· About 10 seconds Β· No sign-up
Real-style posts from builders on X, sharing safety problems they found in their own apps. Different apps, same lesson: something public that should never have been public.
found out my API key was sitting in my app's page source in plain sight, and strangers had been using it without me knowing. I didn't even know you could VIEW the code like that π check your keys people
a kind stranger just emailed me a spreadsheet of MY OWN USERS. my Supabase table was wide open, no row level security. anyone with the link could read every email address. fixed now but wow
TIL the "admin" page of my app was only hidden in the menu. the page itself had zero protection. a user guessed /admin and could see everything. hiding a button is not security π
three weeks after launch I found out Google had never indexed my site. no sitemap, and my robots file was blocking everything from the starter template. three weeks of invisible. check the basics!!
Most AI-built apps have a gap or two hiding in plain sight. Here's why they're worth fixing:
If your OpenAI key is sitting in public code, anyone can use it β and the usage lands on your account, not theirs. Builders tend to find out about this one the hard way.
An open database table means visitors can read your users' emails and details β information your users trusted you to keep private.
Platforms and providers shut down apps with keys visible in public code or customer data left open. Sometimes with no warning and no appeal.
Users forgive bugs. They don't forgive finding their email address in a stranger's spreadsheet. Reputation doesn't have an undo button.
No special skills needed. No special tools. Just a browser β the same one you're using now.
They find it on X, Product Hunt, or Google. It looks lovely. They're curious how it works.
Two clicks in any browser: "View source". Everything your app sends to visitors is right there β including things you never meant to send.
Sitting in plain sight, exactly like this:
A key in plain sight can end up used on other people's projects β and the usage shows up on your account. Much better to spot it in a scan first.
Drop in your app's address. No sign-up, no login, nothing to install.
We run the same 8 checks a careful human would β in about 10 seconds β and explain every problem in plain words.
Every problem comes with a ready-made prompt. Paste it into Lovable, Bolt or Cursor, and the builder fixes it for you.
The 8 things we check on every scan β the same checks, every time, for every app.
You never get a scary report and a shrug. Each problem includes a prompt written for your AI builder β copy, paste, done.
Your customer list is sitting in an open database table. Here's the exact fix β give it to the same AI that built your app:
Turn on Row Level Security (RLS) for the "profiles" table in Supabase. Add a policy so each signed-in user can only read and update their own row (where user_id equals the logged-in user's id). Nobody who isn't logged in should be able to read the table at all. Show me the SQL and confirm when it's applied.
The same app, before and after pasting three fixes into its builder. Try both reports yourself:
Great work, real expertise β and a waitlist, a big invoice, and a report full of jargon you'll have to decode yourself.
Blog posts, docs and forum threads β assuming you already know what to search for. Most builders don't know what they don't know.
The same 8 launch checks, in plain words, with fixes you paste into your builder. Your first scan is free.
Fair question. No β and here's exactly why we couldn't if we wanted to:
We look at your app exactly the way any visitor β or Google β already can. If a stranger can see it, we can. If they can't, neither can we.
We never ask for your password, your builder account, or your source code. Your idea, your users' private data, your backend β all out of reach.
A scan is read-only. We don't touch settings, click buttons inside your app, or change a single thing. The fixes are yours to paste β or ignore.
Your report lives at its link. We don't build a database of everyone's weak spots β that would be a strange thing for a security tool to do.
Share it with a co-founder or keep it to yourself. No account, no dashboard full of your business details.
Every app gets the same 8 checks, scored the same way. No favourites, no scare tactics to make you pay β the free list shows every problem we find.
No subscription. No "cancel before they charge you" games. Pay once, keep your report forever.
π³ Checkout is a secure Square payment page (sold by Future Assisting Co) that accepts card and Cash App Pay. Prefer to pay by Cash App directly? You can send it to $littlewm at checkout instead β those payments are verified by hand, and your report unlocks on the next daily check.
After a scan, three short emails land in your inbox: your report, a nudge about your most urgent problem, and a follow-up on day three. Here they are in full, so there are no surprises:
VibeCheck is a defensive tool: it checks an app you own for safety gaps, using only what any visitor can already see. Three things worth knowing before you scan:
It's built to check apps you own and hand you the fixes in plain words, so you can close the gaps yourself. It only ever looks at what's already public.
Code you paste is scanned right here on your device β nothing is uploaded. Your report and settings stay in this browser too.
The scan and the full problems list are free. The fix report is $9 once, or $29 for ten reports β no subscription, nothing recurring.
Ten seconds, plain words, fixes included. The stranger won't send you a friendly report first.
Check my app β freeOne-time. Keep the report link forever.
Pay on Square's secure checkout β by card or with Cash App Pay. It opens in a new tab; come back here when you're done.
Secure checkout by Square Β· Sold by Future Assisting Co Β· Card & Cash App Pay accepted