Built with Lovable, Bolt, Cursor, Replit or v0?
Is your app actually safe to charge people money?
Your AI built it in a weekend — and quietly left some doors unlocked. Paste your link and get a plain-English security grade in 60 seconds, plus the exact fix for every issue.
Free — no signup · Your code stays yours · Results in ~60s
Deep checks for the tools you build with
- Lovable
- Bolt
- Supabase
- Firebase
- Replit
- v0
- Cursor
// THE PROBLEM
The AI wrote code that works. Nobody checked if it was safe.
of AI-generated code ships with a security vulnerability
Veracode, 2025
API keys leaked from a single vibe-coded app — from one database rule nobody checked
Moltbook breach, 2026
for an attacker to go from finding your app to owning your data
Industry average
// WHAT ACTUALLY GOES WRONG
Six ways a weekend app quietly hands over the keys.
None of these show up as a bug. Your app looks like it works — because it does. The doors it left unlocked are simply invisible until someone walks through one.
Your database is set to “public”
Row-level security or Firebase rules left open means the app works for everyone — including strangers who never signed up.
What it costs you
Every customer’s data — names, emails, orders — readable by anyone who opens your site’s network tab.
Seen in the wild: Lovable · Moltbook · Tea
Your secret keys ship inside the page
AI tools drop API keys straight into the browser bundle, where they’re one right-click away.
What it costs you
Someone drains your Stripe, runs up your OpenAI bill, or takes over whatever those keys unlock.
Seen in the wild: Enrichlead
The lock is on the browser, not the door
When the “are you allowed?” check runs in the browser, the visitor is the one holding the key.
What it costs you
People bypass your paywall by editing one value in the console — you keep the users and lose the revenue.
Seen in the wild: Enrichlead
Anyone can fake “payment succeeded”
Payment webhooks that skip signature checks trust any request that shows up looking official.
What it costs you
Free lifetime access for anyone who reads your API docs — and fraudulent orders polluting your data.
Your uploads are a public folder
Storage buckets set public expose every file your users upload — often with no link required.
What it costs you
ID photos, invoices and private images sitting in the open, ready to be scraped and dumped.
Seen in the wild: Tea
User input runs as code
Unsanitized input passed into a database query lets an attacker rewrite that query.
What it costs you
Your database gets dumped — or wiped — by a single carefully crafted request.
// IT’S ALREADY HAPPENING
This isn’t hypothetical. It’s last Tuesday.
Every one of these was a real, working app — often praised for how fast it shipped — until someone opened the network tab. The pattern is always the same, and it’s the exact pattern Veilguard scans for.
A founder proudly shipped a SaaS with “zero hand-written code” — and all the security logic in the browser. Within 72 hours, users worked out they could unlock the paid plan by changing a single value in the console.
Paywall bypassed, API keys maxed out, database flooded with junk.
Researchers scanned live Lovable-built apps and found 170+ where anyone could pull full user lists, payment records and API keys straight from the database using the public key — no login required.
Names, emails, addresses, payment data and developer keys exposed across 303 endpoints.
A storage bucket left wide open leaked 72,000 images — including 13,000 selfies and photo IDs — plus more than a million private messages. The files were dumped on 4chan within days.
Driver’s licenses and DMs used to dox and harass users, followed by lawsuits.
An AI-built social network exposed its entire database — 1.5 million auth tokens, 35,000 emails and private messages — to anyone holding the public API key. Row-level security had simply never been turned on.
1.5M API tokens and 35,000 emails exposed to the public internet.
of 20,000+ launched indie apps expose their Supabase keys in the browser
SupaExplorer, 2026
of 1,072 vibe-coded apps scanned had at least one security flaw
Symbiotic Security, 2026
live apps exposed by one class of Lovable misconfiguration alone
CVE-2025-48757
// HOW IT WORKS
Scan. Understand. Fix.
No install, no signup, no security degree required. Three steps from “is this a problem?” to “done.”
Scan
Paste your app’s link. No install, no signup — just the URL you already share with customers.
Understand
A clear A–F grade and every issue in plain English: what it is, why it matters, and how bad it really is.
Fix
The exact fix for each issue — copy-paste code or a ready-made prompt for your AI. Then we keep watching.
// THE DIFFERENCE
Other scanners hand you a scary list. We hand you the fix.
create policy "read orders"on orders for selectusing ( auth.uid() is not null -- lets ANY logged-in user read all rows);
create policy "read orders"on orders for selectusing ( auth.uid() = user_id -- each user only reads their own rows);
Paste it into Supabase and you’re done. Not technical? Copy the prompt and let your AI apply it.
// ALWAYS ON
You’ll keep vibe-coding. We’ll keep watching.
Every new feature can open a new hole. Veilguard re-scans your app on every deploy and emails you the moment something breaks — so a shipping streak never turns into a breach.
Veilguardjust nowNew critical issue detected on myapp.lovable.app
Last night’s update exposed a new API key in your public bundle. We caught it 2 minutes after deploy.
// SECURITY SCANNERS
A security scanner for every AI builder.
Whatever you built with — Lovable, Bolt, Replit, v0 or Cursor — and whatever it runs on, we know where that stack tends to leak. Pick your tool for a scan tuned to it.
// PRICING
Scan free. Pay only to fix.
The grade and every issue are free, forever. You only pay when you want the fixes or someone watching your back as you ship.
Free scan
See exactly where you stand.
- Full A–F security grade
- Every issue found & explained
- Plain-English results
- No signup required
Guard
Stay safe as you keep shipping.
- Unlimited scans + all fixes
- Auto re-scan on every deploy
- Instant email alerts
- Deep Supabase & Firebase audit
Fix Pack
Fix everything from one scan.
- All fixes for one scan
- Copy-paste code + AI prompts
- Downloadable PDF report
- No subscription
// FAQ
The nervous-founder questions.
Do you see or store my code?
The free scan only looks at your live app from the outside — exactly what an attacker already sees. Deeper checks are opt-in, read-only, and your source is never stored.
I’m not technical — will I understand the results?
Yes. Every finding is written in plain English, and each fix is either copy-paste code or a ready-made prompt you can hand to your AI.
Does it work with Lovable and Supabase?
Yes — that’s our specialty. Broken Supabase row-level security is the #1 critical issue we find in vibe-coded apps.
Is the scan really free?
Yes. The grade and full issue list cost nothing and need no account. You only pay when you want the fixes or ongoing monitoring.
Find out your grade in 60 seconds.
Free — no signup · Your code stays yours · Results in ~60s