Quick scan
$0
- Secrets in the page and its JavaScript
- Exposed .env, .git, and source maps
- Security headers
- Supabase anon read check
- A fix prompt for every finding
Read-only security scan
Is your vibe-coded app leaking keys?
Paste a public URL. LockYourVibe reads the live site the way a stranger would — JavaScript bundles, forgotten .env files, security headers, and a Supabase read — then hands you a fix prompt for Cursor or Lovable.
Want to see the shape of a bad grade? Open the sample report.
How it works
01
Confirm it's yours
You check a box that you own the app or have permission to test it. We refuse localhost and private networks.
02
We read the public site
The scanner fetches the HTML and same-origin JavaScript, then looks for keys, forgotten files, security headers, and an open Supabase table.
03
Paste the fix into Cursor
Each finding is written in plain English and includes a prompt you can hand to Cursor or Lovable. You review the diff before anything changes.
What the free scan checks
Secrets in the bundle
OpenAI keys, Stripe sk_live, AWS keys, GitHub tokens, Supabase service_role JWTs, Firebase admin keys, and private keys.
Files that should not be public
GET requests for /.env, /.git/config, and JavaScript source maps. HTML app shells are ignored so a single-page app is not a false alarm.
Browser protections
Content-Security-Policy, HSTS, clickjacking protection, nosniff, Referrer-Policy, and Permissions-Policy.
Supabase read check
If the page ships a project URL and an anon key, we try to read a few common tables. Rows coming back means row level security is not holding.
Pricing
Loading pricing…
FAQ
Is the free scan actually free?
Yes. Paste a public URL, confirm you are allowed to test it, and you get a grade plus plain-English findings. No account.
Will the scan change anything on my app?
No. LockYourVibe sends GET requests only. It reads the public page, same-origin JavaScript, a few common files, and — when it finds a Supabase anon key — tries a read of common table names. It never inserts, updates, or deletes data.
Do I have to own the site?
Yes. The checkbox is required. You need to own the app or have permission from the owner. Scanning someone else's system without permission is outside these terms.
What do you mean by vibe-coded?
An app shipped quickly with AI coding tools such as Cursor, Lovable, Bolt, or v0. Those apps often work on the first demo and still leak a secret key or a database that was left open.
What does the grade mean?
A is a clean quick scan. B and C mean hardening is incomplete. D and F mean something serious is exposed, usually a live key, an open .env or .git folder, or a Supabase table that returned rows to the anon key. The grade covers only what this quick scan can see.
What does the $19 report add?
The full report is $19 at launch (later $29). It repeats the free checks, then goes further: more exposed files, a source-map secret search, Supabase and Firebase rule probes, CORS, and the rest of the header checks. Every finding has a fix prompt, and you can print or download the report. Buy it from the results page after a free scan. Refunds within 7 days by emailing hello@lockyourvibe.com.
Do you store the scan?
This version does not keep a scan database. The redacted report is packed into the share link in your browser. Anyone with that link can read the redacted findings. Newsletter emails are stored only if you join the launch list.
Is a good grade a security guarantee?
No. This is a passive check of the public surface, not a penetration test and not a compliance audit. A quiet result means these particular checks did not fire.