Free · launching soon
Free Vibe Check
When it launches, you paste your app's live URL and we look at it the way any visitor (or attacker) can: the page, the JavaScript files your browser downloads, and the response headers.
What we check
- Secret keys in your shipped bundle (Stripe
sk_live, OpenAI, Supabaseservice_role, and more) - Exposed files like
/.env,/.git/configand source maps - Security headers (CSP, HSTS, X-Frame-Options)
- Blank-screen and console errors on load
What we never do
No logins, no form submissions, no writes, no load testing. Passive checks only. Deeper testing needs a paid Rescue Report and written authorization.
Free Vibe Check is launching soon. Join the waitlist
Scans aren't live yet. Join the waitlist and you'll be first in line when they open. You'll also get Patch Notes, our weekly newsletter (unsubscribe anytime).
Can't wait? Run the 5-minute manual check in our leaked-keys guide.