89.5% of vibe-coded apps — Lovable, Bolt, v0, Cursor, Replit — have at least one security risk. Scan your deployed app for an exposed Supabase database, open Firebase rules, and leaked API keys in seconds, completely free.
Your Supabase anon key is public by design — but if RLS is misconfigured, anyone can read your entire database. The #1 leak in AI-built apps, invisible to code scanners.
A service_role key shipped in your bundle bypasses all database security. We catch it before someone else does.
Public read/write on your Firestore or Realtime Database.
Hardcoded API keys and known-vulnerable packages — with the public-by-design noise filtered out.
In independent testing of more than 100 AI models, Veracode found that 45% of AI-generated code shipped with a known security flaw — and the rate didn't improve with newer, larger models. AI coding tools optimize for making the app run, so they scaffold with the permissive defaults that reach a working demo fastest: Row-Level Security off, database rules open, API keys inlined into the frontend. It works on the first try, you ship it, and no engineer reviews the parts a human would have locked down.
The result isn't theoretical. CVE-2025-48757 — a single class of missing-RLS bug — left more than 170 live Lovable apps with databases any anonymous visitor could read, modify, or delete.
Yes — paste your deployed app's URL and get a security grade in seconds, with no signup and no install. We email you the full surface report for free; the deep live-backend probe runs only after you verify you own the domain.
Your public attack surface: an exposed Supabase database (broken Row-Level Security), service_role and other secret keys shipped in your browser bundle, open Firebase / Firestore rules, leaked API keys and .env secrets, missing security headers, insecure cookies, and weak TLS.
Often not by default. Veracode's 2025 testing of more than 100 AI models found 45% of AI-generated code contained a known security flaw — and the rate didn't improve with newer, larger models. AI tools optimize for 'it works,' not 'it's locked down,' so vibe-coded apps routinely ship with an exposed database or secrets in the bundle. That's exactly what this scan catches.
If Row-Level Security is missing or misconfigured, yes. The anon key is public by design and ships in your browser bundle — it's only safe when RLS policies actually restrict what it can read.
The anon key is meant to be public and is safe only when RLS is enforced. The service_role key bypasses RLS entirely and must never reach the browser — if it's in your frontend bundle, anyone can read and write your whole database.
Turning RLS on without a restrictive policy still leaves tables readable, and a permissive 'using (true)' policy exposes everything. Our live probe reads with your anon key exactly as an attacker would, so it catches RLS that's on but not actually protecting you.
A Supabase database left readable because Row-Level Security was never configured. It's the flaw behind CVE-2025-48757, where 170+ live Lovable apps exposed their full databases to anonymous requests. We check for it on every scan.
Broken Object-Level Authorization (also called IDOR) means an endpoint returns another user's record just by changing an ID. AI tools generate CRUD routes without ownership checks all the time, so it's one of the most common flaws in generated backends.
The passive check reads only data your app already serves to every visitor. The active backend probe requires proving you control the domain — we never probe a site you don't own.
Seconds. The public-surface scan grades your app almost immediately; the deeper backend probe runs after you verify the domain.
Yes. We only read what your app already ships to every visitor's browser — no login, and no secrets stored; evidence is redacted at the source. The deep backend probe is read-only and runs only after you prove you own the domain.