Vibeproof

Is your vibe-coded app safe to ship?

Visit website

FreeAI Coding562 impressions#53 this week+1 today

>log in to comment

Vibeproof gives apps built with Lovable, Bolt, v0 and Cursor an instant security scan. Paste a URL or a public GitHub repo to find exposed secrets, open Supabase/Firebase databases, leaked files, vulnerable libraries and GDPR gaps — before hackers do. Free instant scan; the $39 deep scan adds the full Nuclei template set, git-history secret scanning and an AI audit.

AI Coding

Vibeproof scans AI-built web apps for exposed secrets, open databases, vulnerable libraries and GDPR gaps.

for: Developers of AI-built apps using Lovable, Bolt, v0, Cursor, Replit, Supabase or Firebase.
pricing: freemium

works withLovableBoltv0CursorReplitSupabaseFirebase

Key features

6 features of Vibeproof

Free instant scan — Scans a live URL or public GitHub repo in ~15 seconds with read-only requests.
Deep scan — Runs 13,000+ Nuclei templates, testssl.sh, Nikto and AI review for $39 per scan.
Live key verification — Checks leaked API keys against the provider to confirm they are still active.
AI fix prompts — Provides copy-paste prompts for Claude Code, Cursor or Windsurf to automatically fix issues.
Git-history secret scanning — Deep scan examines full repository history for .env files, private keys and tokens.
GDPR & privacy checks — Detects tracking scripts without consent and missing privacy policies.

Use cases

Validate a newly deployed Lovable app before launch.
Audit a public GitHub repo for leaked credentials and vulnerable dependencies.
Check Supabase or Firebase databases for open read access.
Identify missing security headers and TLS weaknesses in a live web app.
Generate a compliance report for GDPR cookie-consent requirements.

Vibeproof FAQ

Is the scan safe to run on my live app?+

Yes. Vibeproof only sends read-only HTTP requests, the same a browser or crawler would make, and never logs in or modifies anything.

Do I need to install anything or connect my repo?+

No. Just paste a URL or public GitHub repo; no signup or installation is required.

What makes the deep scan worth $39?+

It combines multiple engines—full Nuclei templates, testssl.sh, Nikto and an agentic AI review—plus git-history secret scanning and a shareable report with fix steps.

Which tools does this work with?+

It is tuned for apps built with Lovable, Bolt, v0, Cursor, Replit, Supabase and Firebase, but works on any web app.

How are leaked API keys verified?+

The scanner attempts to use the discovered keys against their providers to confirm they are still live.

Summarized by DevHunt from vibeproof.sh · Oct 1, 2026. Details may change; check the official site.