Find out if your app is safe to charge money.
Paste your app link and get a plain-English A to F security grade in 60 seconds, plus the exact fix for every issue.
Join 200+ founders shipping safer apps with Veilguard
Works with the tools you already build with
Everything you need to ship safely.
Track your security posture, understand every finding in plain English, and get the exact fix, without slowing your team down.
Overview
Your progress and what to do next.
You’ve fixed 7 of 25, 18 to go
Keep going, you’re making real progress.
Scan activity
Last 28 days
Recent scans
Three ways to scan your app.
From a 60-second check of a live URL to a deep read of your actual code, pick the scan that fits where your app lives.
Paste a live URL
No access to your code. We probe your deployed app the way a stranger on the internet would.
Connect your repo
A deeper read of your actual source, config and database rules, the issues that never show from the outside.
Upload a folder or ZIP
No Git needed. Drag in your project and we scan the code directly. Same grade, same exact fixes.
The tools build fast. They don't check the locks.
AI writes and ships your app in minutes, but nothing in that loop checks whether it is safe to charge people money. The gap is measurable, and it is not improving.
of AI-generated code ships with a known security flaw (OWASP Top 10)
Veracode, 2025
from a leaked key hitting the internet to bots exploiting it
GitGuardian, 2025
live apps exposed by one Lovable misconfiguration
CVE-2025-48757 (NIST NVD)
to a plain-English A to F security grade
Veilguard
Six ways a weekend app quietly hands over the keys.
None of these show up as a bug. Your app looks like it works, because it does. The doors it left unlocked are simply invisible until someone walks through one.
Your database is set to “public”
Row-level security or Firebase rules left open means the app works for everyone, including strangers who never signed up. Every customer’s data, names, emails, orders, readable by anyone who opens your site’s network tab.
Seen in the wild: Lovable · Moltbook · Tea
Your secret keys ship inside the page
AI tools drop API keys straight into the browser bundle, where they’re one right-click away. Someone drains your Stripe, runs up your OpenAI bill, or takes over whatever those keys unlock.
Seen in the wild: Enrichlead
The lock is on the browser, not the door
When the “are you allowed?” check runs in the browser, the visitor is the one holding the key. People bypass your paywall by editing one value in the console, you keep the users and lose the revenue.
Seen in the wild: Enrichlead
Anyone can fake “payment succeeded”
Payment webhooks that skip signature checks trust any request that shows up looking official. Free lifetime access for anyone who reads your API docs, and fraudulent orders polluting your data.
Your uploads are a public folder
Storage buckets set public expose every file your users upload, often with no link required. ID photos, invoices and private images sitting in the open, ready to be scraped and dumped.
Seen in the wild: Tea
User input runs as code
Unsanitized input passed into a database query lets an attacker rewrite that query. Your database gets dumped, or wiped, by a single carefully crafted request.
Other scanners hand you a scary list. We hand you the fix.
Every issue comes with a plain-English explanation and the exact repair, so you know which one actually matters and exactly what to do about it.
Identifiers, severities and a spreadsheet. Nothing telling you which one is about to cost you customers, or what to type.
File uploads aren’t validated
Not an emergency, but it makes you an easier target.
Two ways. Hand it to your AI, or paste the code yourself.
Once it’s deployed, re-scan and this issue clears itself.
This isn't hypothetical. It's last Tuesday.
Every one of these was a real, working app, often praised for how fast it shipped, until someone opened the network tab. The pattern is the same one Veilguard scans for.
A founder shipped a SaaS with zero hand-written code, the security logic living in the browser and admin keys hardcoded into it. Attackers bypassed the paywall and drained $14,000 of OpenAI usage in days.
Paywall bypassed, keys abused, and the app was permanently shut down.
Source: Revolter TechSupabase tables shipped with row-level security off. Across 170+ live apps and 303 endpoints, anyone with the public key could read emails, payment logs and tokens, no login required.
Emails, payment logs and tokens exposed across 303 endpoints. CVSS 9.3 (Critical).
Source: NIST National Vulnerability Database ↗A public storage bucket exposed 72,000 images, including 13,000 driver’s licenses, alongside 1.1 million private messages.
Driver’s licenses and private messages leaked, followed by class-action lawsuits.
Source: American Bar Association / 404 Media ↗Researchers found the vibe-coding platform let anyone register a verified account for any private app using only its public app ID, walking straight past SSO and every access control.
Every private app on the platform was reachable by a stranger. Patched within 24 hours.
Source: Wiz Research ↗Row-level security was never turned on. 1.5 million API tokens and 35,000 emails were exposed, and attackers could write and delete records as an admin.
1.5M API tokens and 35,000 emails exposed; attackers got admin write and delete.
Source: Wiz Research ↗An AI coding agent wiped the production database during a run, then generated 4,000 fake records to hide that it had done it.
Production database wiped, then 4,000 fake records created to cover it up.
Source: The Register / Fortune ↗28.6 million secrets were exposed on public GitHub in 2025 (GitGuardian). AI-authored commits leak secrets at roughly twice the human rate.
You'll keep vibe-coding. We'll keep watching.
Every new feature can open a new hole. Veilguard re-scans your app on every deploy and emails you the moment something breaks, so a shipping streak never turns into a breach.
New critical issue detected
Last night’s update exposed a new API key in your public bundle. We caught it 2 minutes after deploy. Your security grade dropped from B to D, and the exact fix is waiting in your dashboard.
What founders ask.
Do you see or store my code?
The free scan only looks at your live app from the outside, exactly what an attacker already sees. Deeper checks are opt-in, read-only, and your source is never stored.
I’m not technical, will I understand the results?
Yes. Every finding is written in plain English, and each fix is either copy-paste code or a ready-made prompt you can hand to your AI.
Does it work with Lovable and Supabase?
Yes, that’s our specialty. Broken Supabase row-level security is the #1 critical issue we find in vibe-coded apps.
Is the scan really free?
Yes. The grade and full issue list cost nothing and need no account. You only pay when you want the fixes or ongoing monitoring.
Is my Lovable app secure?
Not automatically. A Lovable app built on Supabase is only safe if Row-Level Security is switched on for every table, and it often isn’t, which can leave your database readable by anyone holding the public key. Paste your URL and Veilguard checks it in about 60 seconds, free.
How do I know if my Supabase database is exposed?
The quickest check: open your live app, press F12, and watch the Network tab for requests to a *.supabase.co address. If data comes back before you log in, it’s readable by anyone. Veilguard runs this and dozens of other Row-Level Security checks for you and shows exactly which tables are open.
Can someone hack an app built with AI?
Yes, and usually without any real “hacking.” Most AI-built apps leak data through misconfiguration, not clever attacks: open databases, secret keys shipped to the browser, or permission checks that run in the browser instead of on the server. They’re easy to find and easy to fix once you know where they are.
Is it safe to take payments on a vibe-coded app?
Only if your payment webhooks verify their signature and your pricing and access checks run on the server, not in the browser. AI tools often skip both, which lets people fake a “payment succeeded” event or unlock paid features by editing one value. Veilguard flags these before you charge real customers.
Do I need to code to use Veilguard?
No. Paste your app’s link and you get a plain-English A to F grade with every issue explained in everyday language, plus a copy-paste fix or a ready-made prompt for your AI tool. If you can ship an app, you can fix what we find.
New to app security? Start here.
Plain-English guides and answers for founders who built with AI, no security background needed.
- The complete security checklist for AI-built appsA real, work-through security checklist for apps built with Lovable, Bolt, Cursor, Replit or v0, database, keys, auth, payments, storage, CORS and git.
- 7 security holes AI coding tools leave behindThe seven security holes Lovable, Bolt, Cursor, Replit and v0 quietly ship, what each one is, why AI tools cause it, what it costs, and how to fix it.
- How do I know if my Supabase database is exposed?A non-developer test for whether strangers can read your Supabase tables: the anon key is fine, but Row Level Security is the real gate. Here is how to check.
- How to check for exposed API keysAn exposed API key is a secret anyone can read from your app. Here is where AI tools leak them, how a non-developer can find theirs, and how to rotate and fix it.
Simple pricing.
Scan and grade free, forever. Pay only when you want the fixes or someone watching your back as you ship.
Free scan
See exactly where you stand.
- Full A to F security grade
- Every issue found & explained
- Plain-English results
- No signup required
Guard
Most popularStay safe as you keep shipping.
- Repo, upload & URL scans + AI-written fixes
- Auto re-scan on every deploy
- Instant email alerts
- Deep Supabase & Firebase audit
Find your grade today.
Paste your app link and get a plain-English A to F security grade in 60 seconds. Free, no signup.