free · no signup · about 10 seconds
Free security check for your vibe coded app
Paste your site's address. You get a grade, a plain list of what to fix, and one message that tells your AI how to fix it.
how it works
Three steps, about ten seconds
01
Paste your site's address
Any site that's live on the internet. No account, no email.
02
We look at it from the outside
We visit your site the way a stranger or a bot would and look for anything that shouldn't be public.
03
Hand the fixes to your AI
Your report comes with one message to paste into your AI tool, with every fix in order.
your report
A grade, then everything sorted by how soon to fix it
Your site gets a grade from A to F. Anything we find goes into one of three groups:
Fix now
Someone could use this against your site or your users today.
For example: A secret key visible in your site's code, a private settings file anyone can download, other sites allowed to read your logged-in users' data.
Fix soon
Nothing is open right now, but a standard protection is missing.
For example: Browser safety settings your site doesn't send yet, login cookies without the usual locks, your server announcing its exact software version.
Good to know
Not a problem on its own. Worth a quick look.
For example: A public Google key worth double checking in your Google account, a setting that's fine today but easy to tighten.
You also see what passed, and what an outside check can't see. Developers can switch to the full technical report: the exact evidence, config for your host and a command to confirm each fix.
what we look for
The mistakes that are easy to miss when an AI writes the code
None of these break your app, so you won't notice them by using it. Anyone who looks can find them, and bots look all day.
Secret keys in your site's code
Your site sends its code to every visitor's browser. We read it for keys that should only ever live on a server, like Stripe, OpenAI, Anthropic, AWS or Supabase secret keys.
Private files anyone can download
Files like .env hold your passwords and keys. If one is published by mistake, bots find it fast, because they ask every site for it.
Missing browser protections
A few settings tell browsers to always use a secure connection and to block common tricks, like other sites loading yours in a hidden frame.
Cookies and access from other sites
Login cookies need a couple of locks switched on. And your site shouldn't let any other website read what a logged-in visitor sees.
safe to run
Safe to run on your live site
We look at what your site already shows the public. We don't try the door.
- It only reads
- It loads pages the way a browser does. It never fills in forms, logs in or tries to break anything.
- It's small
- At most 30 requests per check, which is lighter than one visitor clicking around.
- It's gentle
- A site gets one fresh check a minute at most, no matter how many people ask for it.
- Your report stays private
- Results sit at a link only you have. We never publish them or list them anywhere.
The exact rules the checker follows are on the about page.
guides
What to watch for on your platform
The tools themselves are generally solid. What matters is the app you built with them. Each guide covers what apps on that platform commonly miss and where the fix goes.
Vibe coding security, start to finish ›API keys ›Explainers ›
questions
Free, and the whole report every time
No account and nothing held back. Run it again whenever you change your site.
Is it really free?
Yes. No signup, no email and nothing locked. Paste an address and you get the whole report.
Is it safe to run on my live site?
Yes. It only loads pages and files the way a browser does, at most 30 requests, and it never submits forms, logs in or sends anything meant to break in.
I don't know anything about security. Will I understand the report?
That's who it's written for. You get a short explanation in everyday words and one message to paste into your AI tool, which does the fixing. If you want the technical version, one switch shows everything.
Does a good grade mean my app is secure?
It means the outside of your site is in good shape. We can't see inside your database, your login logic or your code, so an A is a good start, not the whole story. Each report lists what it couldn't check.
Can I check a site I don't own?
The check only looks at what a site already shows the public, but please only check sites you own or have permission to test.