Hello everyone,
We’re all using AI to spin up apps, dashboards, and internal tools in minutes. It’s awesome, but one thing I’ve noticed is that it’s super easy to accidentally leave an API key in your code, forget to lock down a dashboard, or misconfigure a database (like Supabase RLS) when you’re just trying to get a prototype working.
I built an open-source safety tool called VibeScan to help you catch these things before they become a problem. I belive this can help enhance the security of our apps.
The tool I developed is a scanner that lets you check your own domains and projects across platforms like Lovable, Replit, Vercel, and Firebase. It essentially acts as a safety net. You point it at your app, and it will tell you if:
You accidentally left a hardcoded password or API key exposed.
Your database/Supabase has a configuration that lets anyone read it.
You have sensitive data (like customer emails) sitting on a page with no login screen.
Not a gotcha, but a tool for builders. I built this because I wanted a way to double-check my own vibe-coded projects. It’s totally open-source and you can run it locally (Docker or Python).
I thought this community might find it useful to run against your own portfolios or startup domains. I’d love to hear your feedback, and what other checks would make this actually useful for your day-to-day building?
The Github repo of the vibe-code scanner is here:
https://github.com/safeboundai/vibe-scanner
Thanks in advance