Passive by design
No passwords, no login bypass, no database queries, no brute force, and no writes. A free scan reads public files only.
For apps built with AI
Your AI-built app is shipping with the keys still in it.
These tools move fast, and the bundle they ship is public. Paste a URL you own. We read the page, its JavaScript, and a few files that should never be online, then hand you a fix you can paste back into your coding tool.
Usually under 15 seconds. Passive checks only. No logins, no database probes, no writes, no brute force. You may only scan apps you own or are authorized to test.
LovableBoltCursorReplitv0SupabaseFirebase
What a free scan checks
Three looks at what the browser already receives.
Secrets
Secrets in the bundle
Stripe secret keys, OpenAI and Anthropic keys, AWS access key ids, GitHub and Slack tokens, and Supabase service_role JWTs. The public anon key is called out separately, because that one is supposed to be there.
Learn more →Transport
Headers, cookies, and HTTPS
Content-Security-Policy, clickjacking protection, nosniff, Referrer-Policy, cookie flags, CORS, and plain HTTP on a public host.
Learn more →Launch
Ready for a public URL
Title and description, a noindex tag, robots.txt, sitemap.xml, and same-origin links on the homepage. Plus the env and git files that should 404.
Learn more →
How it works
How a free scan works
01
Confirm it's yours
The form asks you to say you own the app or have permission to test it. The terms say the same thing.
02
We look at what is already public
The HTML, up to 10 same-origin scripts, headers, cookies, robots.txt, sitemap.xml, and homepage links.
03
Read the list, then unlock the fixes
Leave an email to see every problem. $9 unlocks a prompt you can paste into Lovable, Bolt, or Cursor.
Only apps you can test
You confirm ownership before the scan starts. Supabase RLS and Firebase rule checks stay locked until that proof exists.
A fix you can paste
Each finding comes with a plain-English prompt for your coding tool. We will not scan private networks or cloud metadata.
Compare
Your options, side by side
Hire a developer
$500+
for one review
A person reads the app, writes up what they found, and sends you a document. Useful when you want someone on the hook. Booking them takes longer than the review, and you still make the changes yourself.
Debug it yourself with AI
6+ hours
of your time, often
Paste the repo into a chat and ask what looks wrong. You spend the evening chasing maybes. The model does not see the live headers or the public bundle unless you go fetch them and show it.
Vibe App Watchdog
About 10 seconds
first scan free
We read the live page and list the problems in plain words. Nine dollars unlocks a paste-ready fix for each one, written for the tool that built the app.
Check an app →Pricing
Pay for the fixes, not a subscription.
One-time payments. The problem list is free after you leave an email. Credits from the 10-pack never expire.
Problems list
$0
Every check we run. Each problem in plain words, with its severity. An email address is required so we can send you the link.
Scan my app free →Fix report
Most popular$9
one app
A copy-paste fix prompt for every problem, written for Lovable, Bolt, and Cursor, plus a permanent link to the report.
Check an app →10 fix reports
$29
credits, they do not expire
Use them on any app you are allowed to test, including a re-check after you ship a fix. Ownership-verified deeper checks are still coming soon.
Check an app →Coming soon
Deeper checks, coming soon
Supabase and Firebase checks stay locked until you can prove you own the domain. Leave an email if you want a note when that opens. Report emails are separate, and each marketing note has an unsubscribe link.