About LeakyVibe
LeakyVibe is a free, passive security scan for apps built with AI app builders such as Lovable, Bolt, v0, Replit and Cursor (often running on Supabase, Firebase or Vercel). You paste your app's URL and in about 15 seconds get a plain-language list of problems and a 0-100 launch-readiness score.
What it checks
- Leaked secret keys in public HTML and same-origin JavaScript (e.g. Supabase service_role, OpenAI/Anthropic, Stripe secret, AWS, GitHub, email API keys, private keys, database URLs)
- Supabase tables readable with the public anon key (Row Level Security off or too open) — only table and column names are noted, never row contents
- Firebase keys and open Realtime Databases
- Public /.env files, stack traces on /api, public source maps
- HTTPS redirect and security headers (HSTS, clickjacking protection, nosniff, referrer policy)
- SEO basics (title, meta description, robots.txt, sitemap) and broken links on the homepage
How it works
Checks are passive and read-only: no brute force, no fuzzing, no writing data. Only scan apps you own or have permission to test. LeakyVibe is a quick first check, not a substitute for a professional security audit.
Pricing
- Free: the problem list and score.
- $9 one-time: full report for one app with where each problem is, why it matters, step-by-step fixes and copy-paste fix prompts for Lovable, Bolt or Cursor.
- $29: pack of 10 full reports, one-time payment.
- Coming soon: weekly monitoring at $19/month (waitlist open).
Languages
Available in English and Spanish (Español).