Skip to content

The problem list is free. A fix prompt for each one is $9.

See pricing
Vibe App Watchdog

Cursor

Cursor writes the repo. Visitors see the deploy.

A secret in a local env file is invisible here. A secret compiled into the hosted JavaScript, or returned at /.env on that host, is not.

  • Keys compiled into the client

    NEXT_PUBLIC_, VITE_, and other browser-exposed values are in the bundle. The scan matches known secret shapes and stores only a masked fragment.

  • The host serving .env or .git

    The laptop .env is not fetched. The deployed host's /.env, /.env.local, /.env.production, /.git/HEAD, and /.git/config are.

  • Cookies and headers on the live response

    Set-Cookie is checked for Secure, HttpOnly, and SameSite. The cookie value is not copied into the report.

Private and loopback addresses are blocked on the hosted scanner. Paste the public https URL.

Scan a URL you own

The same free check as the homepage. You confirm the app is yours before it runs.

Free public scan

After the results

Monitor weekly: $9/mo

The free scan lists what is already public. Watchdog Monitor re-checks that app every week and emails the grade, plus what is new or fixed. Fix prompts stay a separate $9 one-time unlock on the report.

Monitor weekly: $9/mo

Run the free scan first. The monitor button is on the report.

Is Cursor secure? →