Built for Lovable + Supabase builders

You shipped it with AI.
Now make sure it isn't leaking.

VibeShields checks your live app for open databases and exposed keys, tells you what's wrong in plain English, and hands you the exact prompt to paste back into your builder.

Read-only checks
You prove the app is yours first
No code access needed

Critical

A database table can be read by anyone

Anyone on the internet can read rows from your profiles table without logging in, using the public key that is in every Supabase website.

EvidenceGET /rest/v1/profiles → 200 · 3 columns · rows hidden

Paste this into Lovable

Please enable Row Level Security on every table in the public schema, then add policies so signed-in users can only read and change their own rows…

High

OpenAI secret key is visible in your website code

Evidenceassets/index-4f2a.js · sk-proj-••••••••••••Q7xa

Passed

Firebase database is locked to signed-in users

Sample report. Evidence is always masked: we never store your keys or your users' data.

Checks apps built with

Lovable
Bolt
Cursor
Replit
v0
Claude Code

Supabase
Firebase

The problem

AI builds the app. Nobody checks the locks.

AI builders are brilliant at making things work. They are less careful about who else can get in. The two mistakes behind most leaks are simple: a database left open to the whole internet, and a secret key shipped inside the website where anyone can copy it. Neither shows up when you click around your own app.

Open databases

Row Level Security switched off in Supabase, or Firebase rules set to .read: true. Your users' data is one request away from a stranger.

Leaked keys

Stripe, OpenAI or Supabase admin keys bundled into your site's JavaScript. Anyone can spend your money or read everything.

No one tells you

Security tools are made for security teams. If you don't write code, the warnings are jargon and the fixes are a guess.

How it works

From worried to fixed in three steps

1
Add your app and prove it's yours

Paste your app's address, then add one DNS record or one small file. We only ever check apps their owners have verified, and we check again before every scan.

TXT _vibeshields → vs-verify=7c1e••••
2
We look from the outside, like an attacker would

VibeShields loads your live site, reads its code, and tests your Supabase or Firebase database with read-only requests. Nothing is changed, and it takes about a minute.

Website codedone

Supabase tablesdone

Firebase ruleschecking
3
Get a plain-English fix and the prompt to apply it

Every problem comes with what it means, why it matters, the steps to fix it, and a ready-made prompt for Lovable, Bolt or Cursor. Paste, publish, re-check.

Paste into LovableCopy

What we check

The leaks that actually hurt AI-built apps

We start where the real incidents are, and go deep rather than wide.

Open Supabase tables

We try to read each table with the public key every Supabase site ships with. If a stranger could see rows, you'll know which table, and we'll write the Row Level Security policy with you.

Tables readable without login
Public table list
Admin key in the browser

Firebase rules

We check whether your Realtime Database answers anyone who asks, and give you rules that lock each user to their own data.

Leaked secret keys

We read the JavaScript your site sends to every visitor and look for keys that should only live on a server.

Stripe
OpenAI
Anthropic
Supabase service_role
AWS
Azure
GitHub
SendGrid
Slack
Private keys

Explained like a friend would

No CVE numbers, no jargon. Each finding says what's exposed, who could use it, and what to do today. Ask "explain more" and an AI walks you through it.

Your Supabase admin key is visible in your website code

This key skips every security rule in your database. Anyone who finds it can read, change or delete all of your data. Rotate it first, then move the code that needs it into an Edge Function.

Stays checked

Your app changes every day. So does the check.

Re-check on every deploy

Connect a signed deploy hook and every publish triggers a fresh scan. A new leak gets caught the day it ships, not months later.

A weekly email

Every Monday: when your app was last checked, what's still open, and the top things to fix. Thirty seconds to read.

A system that keeps learning

VibeShields is a self-learning AI security system, not a chatbot. When a new kind of leak shows up in AI-built apps, it becomes a check, and every app gets it on its next scan.

Show your users

Earn the badge.
Show you checked.

Once your app is verified and scanned, you can add a "Checked by VibeShields" badge to your site. It shows the date of your last finished check, and it never reveals what was found. It's opt-in and you can turn it off any time.

We say "checked", not "secured", on purpose. No scanner can promise an app is perfectly safe, and we won't pretend to.

Embed code

<a href="https://vibeshields.com">
  <img src="https://api.vibeshields.com/badge/YOUR_APP_ID.svg"
       alt="Checked by VibeShields">
</a>

Safe by design

A security tool should be the safest thing you plug in

Read-only

The scanner only sends GET requests. It never writes, deletes or logs in as anyone.

Owners only

You prove you own the app before the first scan, and we re-check it before every one.

Masked evidence

We keep just enough to show the problem, like the first and last few characters of a key. Never full secrets, never your users' rows.

Separated by design

The scanner runs in its own isolated worker with no access to our database. Your account data is locked per user.

How we keep scans safe →

Questions

Good questions, straight answers

Do I need to know how to code?

No. VibeShields is made for people who build by describing what they want. Every finding comes with a prompt you paste into your builder, and plain steps if you'd rather click through Supabase or Firebase yourself.

Will scanning break or slow down my app?

No. The scanner only reads, with a handful of GET requests, timeouts on every one, and a hard limit per scan. It never submits forms, signs in, or changes data.

Why do I have to prove the app is mine?

Because a tool that looks for open doors shouldn't do it for strangers. You add a DNS record or a small file, and we check it before every scan. For your Supabase or Firebase database, you add a small marker so we only test databases you control.

Do you see or store my data?

We never store full keys or any row from your database. If we find an open table, we record the table name and the fact it answered, not what's in it. Leaked keys are saved masked, like sk-proj-••••Q7xa.

Does it work if I didn't use Lovable?

Yes. The checks look at your live website and its database, so it doesn't matter which builder made it. Bolt, Cursor, Replit, v0 and hand-written apps on Supabase or Firebase all work. The fix prompts are written for Lovable first and work in the others too.

Can VibeShields fix things for me?

You stay in control. We give you the exact prompt and steps, and you apply them in your builder. Then we re-check to confirm it's actually fixed.

Does the badge mean my app is secure?

It means your app was checked by VibeShields on the date shown. That's why it says "Checked by", never "Secured by". It's a sign you take your users' data seriously, not a guarantee.

Find out what your app is showing the world

Add your app, verify it, and get your first plain-English report in a couple of minutes.

Check my app