Free Security Tools for Vibe-Coded Apps
Scanners that read what your app already serves to the public, checkers for your headers, CORS and tokens, and generators that write the fix. Free to run, no account, and no repo or database access.
Comparing security scanners rather than checking your own app? Our ranked comparison of vibe coding security tools covers the options.
Point one at your app
DatabaseSupabase RLS Checker
Probes your Supabase tables with the anon key from your own bundle to see which ones answer without Row Level Security.
OpenDatabaseSupabase RLS Policy Generator
Writes the Row Level Security SQL for a table - enable, select, insert, update, delete - from four plain-English choices.
OpenExposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
OpenSecret Scanner
Paste code, a .env file, or config and find API keys and credentials before you commit. Runs entirely in your browser.
OpenJWT Decoder
Decode a JSON Web Token, check its expiry, verify the signature, and spot Supabase service-role keys. Runs in your browser.
OpenSecurity Headers Checker
Reads the response headers your site actually sends and grades what is missing, weak, or leaking your stack.
OpenCSP Generator
Builds a Content Security Policy and the rest of your security headers as copy-paste config for Next.js, Vercel, Netlify, or Cloudflare Pages.
OpenCSP Evaluator
Paste a Content Security Policy or enter a URL to find unsafe-inline, wildcard and bypassable sources, and missing directives.
OpenCORS Tester
Test a URL's CORS headers and preflight, see exactly why the browser blocks your request, and whether other websites can read your API.
Open
AI BuildersLovable Security Scanner
Checks a published Lovable app for the defaults it ships with: open Supabase tables, keys in the bundle, and ungated routes.
Open
AI BuildersBolt.new Security Scanner
Checks a deployed Bolt.new app for env values that reached the client bundle and endpoints that trust the browser.
Open
AI Buildersv0 Security Scanner
Checks a deployed v0 app for secrets in serialized props, route handlers that answer anyone, and dev surfaces left on.
Open
AI BuildersReplit Security Scanner
Checks a Replit deployment for secrets in the bundle, config files served from the web root, and open debug routes.
Open
AI BuildersCursor Security Scanner
Checks a Cursor-built app for the protections the model never mentioned: throttling, CSRF tokens, and access control.
Open
AI BuildersWindsurf Security Scanner
Checks a Windsurf-built app for the controls the agent never raised: throttling, CSRF tokens, and unguarded endpoints.
OpenWebsite Vulnerability Scanner
The full public scan: bundles, headers, TLS, CORS, endpoints, DNS, and database exposure in a single pass.
Open
DatabaseFirebase Rules Checker
Finds the Firebase config in your bundle and tests whether your Realtime Database answers an unauthenticated read.
OpenExposed .env Checker
Requests the dotfiles, backups, and source maps your host might be serving, and checks whether env values reached the bundle.
OpenVibe Coded App Security Estimator
Answer ten questions about your stack and get an estimated risk profile - no URL and no scan involved.
OpenOne scanner, many front doors
Every tool on this page runs the same Ubserve scan. They differ in what they put first: the Supabase checker leads with whether your tables answer an anonymous read, the API key scanner leads with how many live keys are sitting in your JavaScript. You get the whole check set either way - the entry point just decides which answer you see at the top.
We only read what is already public
The HTML at your URL, the JavaScript bundles that page links to, response headers, the TLS certificate, and public DNS records. No repository, no database password, no service-role key, and no app login. If we find a secret in your bundle, we found it because every visitor's browser downloads it too.
We test, we do not guess
Where your app ships a public database key, we use it the way a stranger would and record what comes back. Every probe is a read - nothing is inserted, updated, or deleted, and no account is created. Requests go out a couple at a time so the scan reads as ordinary traffic.
You see the count and grade for free
A letter grade, the issue count, a severity breakdown, and up to two findings in full - no account needed. The rest of the report, including the highest-severity findings and the copy-paste fix prompts, unlocks with a one-time report unlock or a plan.
What founders say about the scan
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Read before you ship
Pre-launch security checklists for modern AI-assisted stacks. Use these to verify your auth, database, and secret isolation before going live.
Supabase Security Checklist
The complete guide to RLS, auth hooks, and secret management.
Is Cursor Safe?
Where Cursor-built apps break, and the checks that catch it before launch.
Lovable Security Checklist
Security best practices for shipping with Lovable.
Bolt.new Security Checklist
Production readiness for Bolt.new projects.
v0 Security Checklist
Securing apps built with v0 and Next.js.
Windsurf Security Checklist
Launch checks for Windsurf-generated builds.