ShipSnifferFree tools for shipping vibe-coded apps safely
Focused, free checks for the problems we see most in apps built with Lovable, Bolt, Cursor, Replit and v0. Each one runs on your live URL in seconds, with no sign-up.
Supabase RLS checkerFree Supabase RLS checker: find the Supabase anon key your app ships, catch leaked service_role keys, and learn how to confirm Row Level Security is on for every table.Exposed API key checkerFree exposed API key checker: scan your live site's HTML and JavaScript bundles for leaked OpenAI, Anthropic, Stripe, AWS, GitHub and Supabase service keys.Security headers checkerFree security headers checker: test your site for Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy, with copy-paste fixes for Vercel, Netlify and Next.js.Firebase config checkerFree Firebase config checker: find the Firebase web config your app ships, understand what is public by design, and check Firestore and Realtime Database security rules.Lovable app security checkFree security check for Lovable apps: scan your lovable.app or custom domain for leaked keys, Supabase RLS risks and missing security headers before you launch.Vibe coding launch checklistA practical pre-launch checklist for vibe-coded apps built with Lovable, Bolt, Cursor or Replit: secrets, database rules, auth, headers, payments, SEO and launch-day polish.
Want all of it at once?
Run the full free scan →The full scan runs every check above plus SEO, performance and broken links, and gives you a fix prompt for each issue.