For Lovable, Bolt, v0 & Cursor apps on Supabase or Firebase

Is your vibe-coded app leaking?

VibeLeakCheck finds leaked secret keys, admin tokens, exposed .env and .git files and wide-open database tables, then tells you in plain English how to fix each one, with a prompt you can paste straight into your AI builder.

Passive and free: we read only the public HTML, JavaScript and a short list of well-known leak paths. Results stay in your browser tab.

Passive by default Owner-verified active checks Nothing stored
your-app.example Example report, demo data

28Score ยท Grade F

1 Critical 1 High 1 Medium
  • Secret keys in JavaScriptservice_role key in main.jsFail
  • Exposed files/.env is publicFail
  • Security headersNo CSP headerWarn
  • Source mapsNone publishedPass
  • Database rulesNeeds owner verificationNot run
Example of a report: a score gauge, severity counts and a pass, warn or fail list per check. Demo data, not a real site.

What we check

The mistakes AI builders make most often

Everything below runs from the outside, against what any visitor's browser can already download.

Leaked secret keys

Stripe, OpenAI, Anthropic, AWS, GitHub, Slack, Resend and more, inside your public JavaScript. Shown redacted, never stored.

Critical when found

Supabase service_role

We decode JWTs to spot the admin key that bypasses Row Level Security. The public anon key is normal, and we say so.

Critical when found

Exposed files

/.env, /.git, .DS_Store, backups and SQL dumps. We confirm the real file format, so catch-all routes don't cause false alarms.

High to critical

Open tables and buckets

After you prove you own the site, we count which Supabase tables and Firebase paths answer without login. We count rows; we never read them.

Owner-verified only

Security headers

CSP, HSTS, frame protection, nosniff, referrer policy and risky CORS, with a copy-paste config for your host.

Low to medium

Source maps

Published .map files hand out your original source code. We spot them and show how to turn them off.

Medium

How it works

Three steps, about thirty seconds

  1. Paste your URL

    Any deployed app: *.lovable.app, *.bolt.new, *.vercel.app or your own domain.

  2. We scan from the outside

    Your page, its JavaScript bundles and a short, fixed list of leak paths. Read-only, rate-limited, no login.

  3. Fix with one paste

    Every finding has a plain-English explanation, a copy-paste fix and a ready-made prompt for Cursor, Lovable or Bolt.

Our ethics

Passive by default

We only download what your visitors' browsers already download. No logins, no guessing, no writes.

Owner-verified active checks

Database checks need a meta tag, a .well-known file or a DNS TXT record that only the owner can add.

Nothing stored

Reports live in your browser tab and vanish when you close it. Secrets are redacted and never logged.

170 / 1,645

Lovable apps found with exposed data in one 2025 study (CVE-2025-48757)

Why this matters

AI builders ship fast. Their defaults leak.

The usual cause is simple: Row Level Security left off, or a secret key pasted into code that runs in the browser. Both are invisible until someone looks, and attackers look with scripts.

Placeholder: real testimonials go here once real users send them. No fake quotes, logos or user counts.

FAQ

Questions, answered

Is it legal to scan my site with this?

Yes, if it is your site or you have written permission. The passive scan only downloads public files, the same ones every visitor's browser gets. Don't scan sites you don't own.

My Supabase anon key was found. Is that bad?

No. The anon (publishable) key is designed to be public. What matters is Row Level Security on every table. That's what the owner-verified check tests.

Do you read my users' data?

No. The database check asks Supabase for a row count with limit=0, so no row is ever sent to us. We show table names, column names and counts only.

How do I prove I own the site?

Pick one: add a meta tag to your home page, upload a small text file to /.well-known/, or add a DNS TXT record. The token is tied to your exact origin and expires after 7 days.

Do you store my results?

No. The report is returned to your browser and kept in this tab's session storage only. Close the tab and it is gone.

Does a clean report mean I'm secure?

No. It means none of the common, outside-visible mistakes were found. It is a quick check, not a penetration test.

Check your app before someone else does

Free, passive and about thirty seconds. See an example first if you like.

Scan my appView sample report