You coded an app but don't know much about security.
That's fine.
No credit card required
of audited vibe-coded apps contain at least one vulnerability
source: arXiv · 200 deployed apps, 2026of vibe-coded Supabase apps allowed anyone to read their tables
source: Reeve · 30,998 live apps, 2026more security flaws in AI-assisted repos than human-written ones
source: Symbiotic Security · Aug 2026Meet you in the harness, on the host, and in the stack your AI scaffolds — not a generic scanner.
Where you build
How you ship
What you ship with
Two products, one calm. Check asks if the code is safe to merge. Watch asks if the live deploy is locked down.
Is this code safe to merge?
A harness skill that reviews what the AI just wrote — auth holes, injection, secret leaks — before the line ships.
› skill installed: vibe-check
› scanning app/api/payments.ts…
⚠ Stripe webhook accepts unsigned events
Is this live deploy locked down?
Point it at your public URL. We baseline hosting / edge misconfigs, help you fix them, then watch for drift after you ship.
› baseline captured: 12 endpoints
› watching for drift…
⚠ table `users` became publicly readable
A short list of vibe-coded footguns — not a fake catalog. Real classes, with the bad patterns we see most.
Server Actions and API routes that trust the client, or skip a session check because the UI “already gated” it.
// app/actions/admin.ts export async function deleteUser(id: string) { // no auth() / no role check await db.user.delete({ where: { id } }) }
Service keys and webhook secrets landing in NEXT_PUBLIC_* or browser bundles because the scaffold “just worked.”
# .env.local NEXT_PUBLIC_SUPABASE_SERVICE_ROLE=eyJ… NEXT_PUBLIC_STRIPE_SECRET=sk_live_…
Supabase tables readable (or writable) by anon because policies were skipped or copy-pasted wide open.
create policy "public read users" on users for select to anon using ( true );
Handlers that accept unsigned events, or mark orders paid before verifying the Stripe signature.
Missing security headers, open preview URLs, or hosts that never enforced HTTPS redirects after the first deploy.
FREE
For a single app
No credit card required
PRO
For up to 5 apps
No credit card required
Sign up in a minute with GitHub, Google, or a magic link.
No credit card required