What does this security check look at?

It reads your shipped JavaScript for secret-shaped keys (any match is shown masked, never in full), checks for public source maps, probes conventional exposure paths like .env and .git for existence only, audits your security headers, cookie flags and CORS, flags mixed content and matches your front-end libraries against a local vulnerable-version dataset. Every finding shows its evidence.

Why vibe-coded sites specifically?

AI coding tools ship fast, and it is easy to leave a live key in the client bundle, deploy source maps, or forget security headers. Those are exactly the patterns this check surfaces, in the code that any visitor already downloads.

Is this an attack on my site?

No. It is strictly passive: it only reads what your site already serves to any browser. It never logs in, never submits a form, never brute-forces, and never sends an exploit. For sensitive paths it checks only whether they respond, never their contents. This is an indicative posture check, not a penetration test.

You found a key in my JavaScript. What now?

Treat it as exposed and rotate it immediately, then move any server-side key out of client code and behind your own API. Note that some keys (for example a Stripe publishable key or a Supabase anon key) are public by design; we label those as risk context, not as leaks.

Did your AI-built site ship a secret?

A passive security check for vibe-coded and AI-built websites. We read what your site already serves: shipped JavaScript, headers, exposed files and libraries, and show you what is leaking, with the evidence. No login, no exploit.

Your score

Category scores

Top issues found

Scan a different page

Get the full report free

Every issue with evidence and a recommended fix, emailed to you within 5 hours.

First name

Last name

Work email

Phone (with country code)

Company

Your role

Monthly traffic

Budget range (optional)

What do you need?

Preferred contact

Your full report is on its way

It is being prepared by our system and will arrive at within 5 hours, usually much sooner.

Book a call to walk through it

Passive analysis of publicly available signals. Secrets are shown masked; sensitive files are checked for existence only, never read. Findings are indicative, not a penetration test.

What we check

Secrets in JavaScript

Scans shipped bundles for live secret keys and private-key blocks. Any match is shown masked, never in full.

Source maps

Public .map files hand your original source to anyone. We flag bundles that reference one.

Exposed files

.env, .git config and backups, checked for existence only, never downloaded or read.

Security headers

CSP, HSTS, clickjacking and MIME-sniffing protection, plus cookie flags and CORS.

Mixed content

Subresources loaded over plain HTTP on an HTTPS page, which browsers block or downgrade.

Vulnerable libraries

Front-end libraries with public CVEs, matched against a dated local dataset.

Shipped fast, now make it safe

We take AI-built prototypes to production: the security, the polish and the code quality that a launch actually needs.

Hire a vibe coder Talk to us