Paid reports and monitoring are not open yet. A free scan still runs.
Free passive scan
Find the worst public mistake in an AI-built app.
Paste a URL. Vibe Scan reads only what a normal browser visit already fetches: the page, a few scripts, response headers, and public DNS. You get a grade and the single worst finding. Secret values are masked.
What a free scan sees
- Supabase
service_role JWTs, found by reading the role claim, plus common provider key shapes
- Public
/.env, /.git/HEAD, and source maps
- Missing CSP, HSTS, frame protection, and other response headers
- Cookie flags, plain HTTP, and SPF/DMARC on likely mail domains
- Supabase or Firebase client config, marked informational
What it does not do
- No login, no crawl behind auth, no paid API, no model
- No database reads. Deep checks are count-only HEAD requests, and only after you prove you control the domain
- Full secret values are not shown and are not stored
Then go further
$19 once. Coming soon.
$29 per month. Coming soon.
Built for the Cloudflare Workers free plan: small responses, a cap on how many files one scan fetches, and no work that needs a paid API. Read the responsible use rules before you point this at a site.