Your AI built the app.
We check if it leaks.
Millions of people ship apps they didn't fully write — and those apps leak API keys, expose databases, and run without guards. Paste a URL, get a security report in seconds.
Six ways vibe-coded apps leak
Exposed API keys & secrets
We read your pages and every JavaScript bundle, matching 50+ key formats — OpenAI, Anthropic, Stripe, AWS, Supabase, GitHub, database URLs and more.
Supabase & Firebase rules
The #1 vibe-coding leak. We detect your backend and check whether tables, collections or storage can be read by anyone — no login required.
Auth & session flaws
Cookies without HttpOnly/Secure/SameSite, dangerous CORS, insecure login forms, and service keys that quietly bypass every protection.
Open endpoints & leaked files
We look for .env files, exposed .git directories, database dumps, admin consoles and configuration files that should never be public.
Live CVE & malware intelligence
Libraries and lockfiles are checked live against OSV.dev, CISA KEV and EPSS, plus 960+ read-only CVE and exposure tests that grow every day.
AI, MCP & CI/CD risks
LLM keys running in the browser, unauthenticated MCP servers, Next.js middleware bypass, and GitHub Actions script injection.
From URL to report in three steps
- 01
Submit a target
Paste your live app URL, or a GitHub repository — public, or private with a read-only token. Everything is free, with no account.
- 02
Crawl, light or deep
SafeVibe crawls your site like a visitor and shows problems live as each page is analysed. Deep Scan adds active probes once you prove you own the site.
- 03
Get your report
A graded report with severity, redacted evidence, and the exact fix for every finding.
A scanner that gets smarter every day
SafeVibe keeps a permanent library of security tests. Known vulnerabilities are turned into tests once, by deterministic code — no AI, no guesswork. Every hour the library only adds what is new. AI is reserved for researching vulnerabilities nobody has written a test for yet.
- 1
Collect
Every hour SafeVibe reads public vulnerability sources: ProjectDiscovery nuclei-templates, the CISA catalog of actively exploited vulnerabilities, OSV.dev and FIRST EPSS.
- 2
Convert once
Each vulnerability becomes a test a single time and is recorded in a ledger. Anything that would attack a site — exploits, payloads, brute force — is rejected for good.
- 3
Grow incrementally
Later syncs only process what is new or changed upstream, retire tests deleted upstream and refresh which vulnerabilities are exploited in the wild.
- 4
AI for the new
Brand-new vulnerabilities with no test yet go to the AI researcher, once each. Every proposal is reviewed before it reaches your scans.
Safety gates on every test
One GET or HEAD request, no body, no attack payload, product-specific matchers and a full test suite before anything ships.
Smart at scan time
SafeVibe fingerprints your stack (Next.js, Supabase, WordPress…) and only runs the tests that apply. Single-page-app fallbacks never count as a hit.
Live intelligence on top
Every scan checks libraries against OSV.dev; actively exploited CVEs are escalated and ranked by exploitation probability (EPSS).
Claude, used where it adds something
SafeVibe uses Claude Opus 5.5 by Anthropic (model claude-opus-5-5) through the official Anthropic SDK, with schema-constrained outputs. It has two jobs — and it never re-checks what the test library already knows.
AI threat researcher
- Takes CVEs newly added to CISA KEV that have no test yet, and every week searches the web for vulnerabilities just disclosed in the vibe-coding stack.
- Reads the advisories, then drafts a passive test — or explains why no safe test exists.
- Each CVE is researched once; a CVE id is only accepted if it appears in real search results.
- Drafts follow stricter rules than community tests and are reviewed before going live.
AI analyst
- Reviews your site's own code for logic flaws rules can't see: browser-only authorization, hidden admin APIs, unfiltered database queries.
- Secrets are redacted before anything is sent; your site's content is treated as untrusted (prompt-injection protection).
- A finding is kept only if it quotes code that really exists in your bundle.
- APIs it flags are tested by SafeVibe itself, without credentials, and reported only if the response proves a leak.
Free, and built to be used responsibly
Every scan is free, with no account. Passive scans only read what any browser downloads. Deep scans send active probes, so they only run on websites whose owner published a SafeVibe verification token — checked again by the server at the start of every deep scan. GitHub repositories need no verification; private ones use a read-only token you provide.
Questions about SafeVibe
What is SafeVibe?
SafeVibe is a free security scanner for apps built with AI tools (vibe coding). It checks a live website or a GitHub repository for exposed secrets, open database rules, vulnerable libraries, known CVEs and risky configurations, and explains how to fix each finding.
Is SafeVibe free?
Yes. Every scan type is free and needs no account: website scans, deep scans of sites you own, and public or private GitHub repository scans.
What does SafeVibe check?
Exposed API keys (OpenAI, Anthropic, Stripe, AWS, Supabase…), Supabase Row Level Security and Firebase rules, cookies and CORS, leaked files such as .env or .git, admin panels, vulnerable JavaScript libraries, 960+ CVE and exposure tests, GitHub Actions risks and malicious npm packages.
Is it safe to scan my website?
Yes. A light scan only reads what a browser already downloads. A deep scan sends read-only probes and runs only after you prove you own the site with a meta tag, a /.well-known file or a DNS record. No check changes data or sends attack payloads.
Can SafeVibe scan private GitHub repositories?
Yes. Create a fine-grained GitHub token with read-only access to that repository and paste it in the scanner. It is sent in the request body over HTTPS, used in memory for the scan only, and never stored or logged.
How does SafeVibe stay up to date?
An hourly sync reads public detection templates and the CISA list of exploited vulnerabilities. Each vulnerability becomes a test once and is kept in a permanent catalog; only new or changed items are processed again.
Does SafeVibe use AI, and what happens to my code?
AI (Claude by Anthropic) researches brand-new vulnerabilities in the background. The optional per-scan AI analyst is off by default; when enabled, secrets are redacted before your client-side code is sent, and every AI finding is verified against the code.