89.5% of functionally-correct AI-generated code still fails security checksarXiv↗

Your vibe-coded app has security gaps. We find them.

Paste a URL or code snippet. Get a 0–100 security score, detailed findings, and AI-ready fix prompts formatted for Cursor, Claude, Bolt, or Lovable. First scan is free — no account needed.

No credit card 1 free scan/day, no signup Results in under 60s

Sample Report

Scanned just now

64/100
Exposed OpenAI API Key
Missing CSP Header
Cookie missing Secure flag

How it works

Three steps from vulnerable to verified. No terminal, no security degree.

01

Paste URL or code

Enter your deployed app URL or paste a code snippet. We never store raw input without permission.

02

Get scored + findings

In under 60 seconds, get a 0–100 score and detailed findings with evidence and risk explanations.

03

Copy fix prompt

Generate an AI-ready fix prompt for Cursor, Claude, Bolt, or Lovable. Paste it and re-scan.

What you'll get

Every scan produces a structured report like this. No AI fluff — deterministic, reproducible findings.

your-saas.com

URL scan • 450ms • v0.2.0

64/100

Potential exposed OpenAI API key

secret_detection

critical

Evidence: line 1247: const KEY = '[REDACTED_SECRET]'

Risk: Anyone visiting your site can extract this key and make API calls billed to your account.

Missing content-security-policy header

secret_detection

high

Evidence: content-security-policy: not present

Risk: Without CSP, injected scripts can execute in your users' browsers.

Cookie missing recommended security flags

secret_detection

medium

Evidence: Set-Cookie header is missing Secure, HttpOnly, or SameSite.

Risk: Session cookies without security flags are easier to steal.

Generated fix prompt (Cursor format)Copy
Use this as a Cursor task.

Project context: VibeShield scanned your-saas.com and returned a score of 64/100.
Goal: fix the security findings below without changing unrelated behavior.

Finding 1: Potential exposed OpenAI API key
- Severity: critical
- Evidence: line 1247: const KEY = '[REDACTED_SECRET]'
- Recommended fix: Move the key to a server-side environment variable and call it through a protected API route. Never expose API keys in client-side bundles.

Finding 2: Missing content-security-policy header
- Severity: high
- Evidence: content-security-policy: not present
- Recommended fix: Add a restrictive CSP header. Start with default-src 'self' and tighten from there.

Finding 3: Cookie missing recommended security flags
- Severity: medium
- Evidence: Set-Cookie header is missing Secure, HttpOnly, or SameSite
- Recommended fix: Set Secure, HttpOnly, and SameSite=Lax on all session cookies.

---
After applying these fixes, re-scan with VibeShield to verify the score improves.

Try it now

Anonymous users get 1 free scan. Sign in for 3 daily scans + fix prompts.

Most vibe-coded apps fail this check. See where yours stands.

Run a scan

Scans the live page: headers, secrets, injection patterns, and cloaking detection.

Scan results will appear here.

Simple pricing

Bring your own API key for unlimited free scans. No credit card, ever.

Free
$0

No key. No card. Instant start.

  • 3 scans/day + 3 permanent bonus
  • 1 prompt/day + 3 permanent bonus
  • URL, code, and file scanning
  • 7-day scan history
Start scanning
BYOK
$0

Your key. Our scanner. Unlimited AI.

  • Unlimited AI-powered fix prompts
  • Use your own API key
  • Supports major AI providers
  • Your key. Your cost. Full control.
  • 7-day scan history
Add your key
ProBest value
$9/month

Ship code that doesn't leak.

  • Unlimited everything — scans, prompts, files
  • Page crawling — scan entire sites
  • Server-side AI — nothing to configure
  • Full finding reports with evidence
  • AI-powered findings verification
  • Unlimited scan history with trends
  • Priority support — we respond fast
  • Highest ROI — fix issues before they leak
Go Pro

FAQ

Common questions about VibeShield.

What does VibeShield scan for?

Hardcoded API keys and secrets (OpenAI, Stripe, Supabase, GitHub, AWS — 150+ patterns), missing security headers (CSP, HSTS, X-Frame-Options, and 6 more), insecure cookie flags, information disclosure, CORS misconfigurations, content injection vectors, SEO cloaking, and exposed sensitive files (.env, .git, backups, Docker configs). New checks ship weekly.

Is my code safe when I paste it?

Yes. Scans run server-side. We never log raw code. Secrets in evidence are automatically redacted before storage — what you see in results has the actual key replaced with [REDACTED_SECRET]. Scan results are retained for 7 days (Free) or 1 year (Pro). Full details in our Privacy Policy.

What is a fix prompt?

A structured instruction formatted for your AI coding tool. It includes the finding context, severity, evidence, and a recommended fix — copy, paste into Cursor or Claude Code, and the AI applies the fix. No manual hunting through docs.

Which AI coding tools are supported?

Cursor, Claude Code, Bolt.new, Lovable.dev, and a generic format that works with any AI coding assistant.

Is it really free?

Yes — no credit card, no trial expiration. Anonymous: 1 free scan/day. Free account: 3 scans/day + 3 permanent bonus scans + 1 AI fix prompt/day + 3 permanent bonus prompts. Need more? BYOK (bring your own API key) gives you unlimited AI prompts at zero cost to us. Pro plan for unlimited scans.

What makes VibeShield different?

Real 0–100 security score, not pass/fail. Scan URLs, paste code, or upload files — your choice. AI-ready fix prompts that actually work in your coding tool. BYOK: bring your own API key for unlimited AI prompts. Deterministic checks — no AI hallucination in scanning. Under 60 seconds per scan. Free tier that's actually useful.

What is page crawling?

Page crawling (Pro feature) automatically discovers and scans every page on your site — not just the one URL you submit. It reads your sitemap, follows internal links, and probes common paths to find vulnerabilities across your entire application. A single-page scan catches ~15% of issues. Crawling catches the rest. Max 50 pages per crawl, rate-limited to 1 request per second to your server.