For apps built with Cursor, Lovable, Bolt, Replit, v0
Ship your vibe-coded app without shipping the leaks.
Paste a live URL. Get a plain-English A–F launch report covering security holes, deploy blockers, and basic perf/SEO — plus copy-paste fix prompts for Cursor and Lovable.
Sourced: SymbioticSec scanned 1,072 vibe-coded Supabase apps and found 98% had at least one security flaw.
What we check
Automated, read-only probes. No destructive exploits. Results in plain English.
Security
- Exposed API keys in JS bundles
- Supabase RLS / Firebase rules gaps
- Missing auth & open endpoints
- Security headers & TLS basics
Deploy blockers
- Exposed .env, .git, source maps
- Debug / admin paths left public
- Broken redirects & mixed content
- Obvious misconfig signals
Perf & SEO
- Core Web Vitals snapshot
- Title, meta, robots basics
- Mobile viewport & index signals
- Slow assets called out simply
Sample report preview
Illustrative layout — not a real customer scan.
example.lovable.app
Launch check · illustrative
Supabase table readable without auth
Anon key in the client bundle can list rows on profiles. Enable RLS and restrict by auth.uid().
Fix prompt ready for Cursor / Lovable →
Possible Stripe secret pattern in JS
Rotate the key, move billing calls server-side, and remove it from the bundle.
Missing meta description
Add a one-sentence description so link previews and search snippets are not blank.
Simple pricing
Free quick scan
Free
- Public headers & TLS glance
- Obvious secret patterns
- Count of findings by severity
- No signup
$29 full report
$29 one-time
- A–F grade across security, deploy, SEO/perf
- Plain-English findings with evidence
- Copy-paste Cursor / Lovable fix prompts
- Shareable report link · Stripe checkout
Monthly re-check
$12/mo
- Automatic weekly rescans
- Email alert when something new breaks
- Latest grade & diff vs last week
- Cancel anytime · Stripe subscription
FAQ
- Is scanning safe?
- Yes. We only send read-only HTTP requests and passive probes. We do not log in, submit forms, write data, or run exploits. You must own the URL or have permission.
- Do you need my GitHub?
- No for v1. Paste a live URL. Optional public-repo scan may come later.
- Is this a pentest?
- No. It is an automated launch checklist for common vibe-coding mistakes — not a full security audit.
- How do payments work?
- Free quick scan first. Unlock the full report for $29 via Stripe Checkout, or subscribe to Monthly re-check at $12/mo for weekly rescans and email alerts.
Join the waitlist
Be first when PreflightVibe opens. No spam.
Launch updates only. Unsubscribe anytime.