Before they do.
How Secure Is Your
Vibe Coded App?
Scanned in Seconds with Actionable Fixes.
SSL, Headers, Supply Chain, Info Leaks, DNS, and Best Practices.
Enter any URL to get a full security audit with a letter grade
What Vibe Coders Are Saying
Real feedback from the Skool hackathon community after testing the scanner on their own apps.
"I am using a combination of Lovable, ChatGPT, Claude Code to fix issues. Your site found more issues than the three combined. A few issues were unrelated to my platform but it was still eye opening."
"This app was super easy, and very Vibe Coder friendly. The results are easy to follow and I look forward to getting an A+ security report card once I implement some changes. This app gets an A+++"
"This is so cool! You're probably killing one of my tutoring areas in my AI learning platform already, which is the security part."
"Great work! Clean UI. Provides clear actionable results even if you don't understand them!"
"Great app. I tested on my app and went from A- to A+. Will book mark it and spread the word!"
"It is INSANE what we can already create within hours. Production ready products. Wow."
"This is really good mate! I can see this becoming such a useful tool!"
"Very cool. Got three failures that I do not understand at all but I am having Claude look into them now. Very useful, thanks for sharing!"
"This is really cool. My app got a B lol. Glad I was able to copy and paste so Claude can fix."
"Love it"
"This is awesome!"
"Cool!"
"Oh cool, I'm going to use that!"
"Love the idea and design!!"
"Looks Great!"
25 Security Checks Across 6 Categories
Every check maps to real-world attack vectors. Each one gives you a score, a finding, and a fix.
SSL / TLS
25% weightCertificate validity, mixed content detection, TLS version and cipher strength. The foundation of transport security.
Security Headers
25% weightCSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy. The headers most vibe-coded apps completely miss.
Supply Chain
15% weightSRI attributes, vulnerable libraries, third-party resource audit, CORS config, suspicious iframes, and redirect chain quality.
Info Disclosure
10% weightExposed .env files, .git directories, server version headers, cookie flags, private IPs, and robots.txt leaks.
DNS Security
20% weightSPF, DKIM, DMARC for email auth. CAA records for certificate control. DNSSEC for DNS integrity.
Why DNS security mattersBest Practices
5% weightBaaS security audit (Supabase/Firebase key exposure, RLS), security.txt per RFC 9116.
Three Steps to Your Security Grade
Enter Your URL
Paste any publicly accessible URL. No account needed, no setup required.
We Run 25 Checks
SSL, headers, supply chain, info disclosure, DNS, and best practices. All scanned in seconds.
Get Your Grade + Fixes
A letter grade from A+ to F, category breakdowns, and code-level remediation for every finding.
Frequently Asked Questions
The scanner runs 25 checks across 6 categories: SSL/TLS (certificate validity, mixed content, TLS versions), Security Headers (CSP, HSTS, X-Frame-Options), Supply Chain (SRI, vulnerable libraries, third-party resources), Info Disclosure (exposed .env files, server version leaks, cookie flags), DNS Security (SPF/DKIM/DMARC, CAA records, DNSSEC), and Best Practices (BaaS security, security.txt).
Each check scores 0-100 based on four tiers: Pass (100), Acceptable (70), Weak (30), or Fail (0). Category scores are weighted: SSL/TLS 25%, Headers 25%, Supply Chain 15%, Info Disclosure 10%, DNS 20%, Best Practices 5%. Critical failures can cap your grade regardless of score, and a domain with no DMARC policy is capped at B. Bonus points are available for A+ qualification.
Yes, the scanner is completely free. Enter any URL and get a full 25-check security audit with a letter grade, detailed findings, and code-level fixes. No account required.
Grade caps are hard limits triggered by critical security failures. For example, no HTTPS caps your grade at F, exposed secret keys cap at D, active mixed content caps at C+, missing HSTS caps at A-. Even a high overall score cannot override a grade cap.
Vibe coding is building apps with AI assistants like Claude, Cursor, or Copilot. While it accelerates development, AI-generated code often skips security headers, exposes environment variables, omits SRI attributes, and uses outdated libraries. This scanner catches the gaps that AI typically misses.
First, score at least 90 points with no grade caps active. Then earn bonus points: HSTS preload with max-age over 1 year (+3), SRI on all external scripts (+3), DNSSEC enabled (+2), CAA records present (+2), DMARC with p=reject (+2), complete security.txt (+1). You need 97+ total points with no warnings to qualify for A+.
No. The URL you enter is sent to our server, which fetches the site and returns the results. We do not store the results. The only third party is Sentry, which receives error reports so we can fix bugs, with personal data collection turned off.
You can scan any publicly accessible URL. The scanner only checks publicly visible information like HTTP headers, DNS records, and page source. It does not perform intrusive testing or exploit vulnerabilities.
DNS tells the world who may send mail for your domain and who may issue its certificate. Without SPF and DMARC, anyone can send mail that looks like it comes from you, so a domain with no DMARC policy is capped at B. CAA limits who can issue your certificate, and DNSSEC signs your DNS answers. All four take about ten minutes to add; the DNS security page explains each one with the exact records.
Learn Security First
Vibe Coding
New to Vibe Coding? Start From Scratch With a Full Curriculum.
Security, Tech Stack, Plan Mode, and Real Builds. No Experience Needed.