Free · ~2 minutes
Free Vibe Check
Paste your app's live URL. We look at it the way any visitor (or attacker) can: the page, the JavaScript files your browser downloads, and the response headers.
What we check
- Secret keys in your shipped bundle (Stripe
sk_live, OpenAI, Supabaseservice_role, and more) - Exposed files like
/.env,/.git/configand source maps - Security headers (CSP, HSTS, X-Frame-Options)
- Blank-screen and console errors on load
What we never do
No logins, no form submissions, no writes, no load testing. Passive checks only. Deeper testing needs a paid Rescue Report and written authorization.
🚧 Coming soon: the free Vibe Check isn't live yet. Submissions are switched off, so nothing you type here is sent or saved.
Launching soon. The waitlist opens on this page shortly. Until then, you can run the 5-minute manual check in our leaked-keys guide.