Live scanner — no account needed

Ship your app.
Not your secrets.

Paste a GitHub repo or deployed URL. VibeGuard scans for exposed keys, missing headers, open config files, and more — before attackers find them first.

critical

Stripe Secret Key Exposed

src/lib/stripe.ts · line 3

critical

.env File Committed to Repo

.env · root directory

high

HSTS Header Missing

Live site · response headers

high

No Content-Security-Policy

Live site · response headers

medium

OpenAI Key in Client Bundle

src/app/api/chat/route.ts

Zero setup. Full scan.

No accounts, no installs. Paste a link and get a complete security audit in under 30 seconds.

01 / PASTE

Paste your link

GitHub repo or live deployed URL — we detect which kind of scan to run automatically.

02 / SCAN

We scan everything

20+ checks across your files, headers, exposed paths, and HTML source — all in parallel.

03 / FIX

Copy the fix prompt

Every issue comes with a ready-made prompt. Paste it into Cursor, Bolt, or Lovable — done.

What VibeGuard checks

Every check maps to a real attack vector. No theoretical warnings, only things attackers actually exploit.

Exposed API Keys & Secrets

AWS, OpenAI, Stripe, GitHub, Supabase and Firebase keys hardcoded in source files.

.env Files in Repository

Flags .env, .env.local, or .env.production accidentally committed to git.

Publicly Accessible Config

Checks if /.env, /.git/config, /credentials.json are live and readable.

Missing HTTPS / HSTS

Verifies your site enforces HTTPS and sends Strict-Transport-Security headers.

Content-Security-Policy

Checks for a CSP header that blocks XSS and data injection in users' browsers.

Private Keys & Certificates

Detects PEM private keys, RSA keys, and service account JSON in your codebase.

X-Frame-Options Header

Stops clickjacking by preventing your site from loading inside an iframe.

Secrets in HTML Source

Scans your live site's HTML for API keys accidentally bundled client-side.

Sensitive Console Logs

Finds console.log calls leaking tokens, passwords, or user data to the browser.

What your report looks like

Plain-English issues with one-tap AI fix prompts — no security knowledge needed.

github.com/user/ecommerce-app

At Risk

5 issues · 8 / 20 checks passed

2Critical

2High

1Medium

critical

Stripe Secret Key Hardcoded in Source

A live Stripe secret key (sk_live_...) was found directly in your source code. Anyone with repo access can charge your Stripe account or read customer payment data.

Cursor / Bolt / Lovable fix prompt

Remove the hardcoded Stripe key from src/lib/stripe.ts. Move it to an environment variable named STRIPE_SECRET_KEY in .env.local, add .env.local to .gitignore, and update the code to use process.env.STRIPE_SECRET_KEY instead.

high

No Content-Security-Policy Header

Your live site doesn't send a CSP header, leaving users vulnerable to XSS attacks where malicious scripts can run in their browsers and steal session data.

Cursor / Bolt / Lovable fix prompt

Add a Content-Security-Policy header to next.config.ts inside the headers() async function with this policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;

Ship your app.Not your secrets.

Zero setup. Full scan.

Paste your link

We scan everything

Copy the fix prompt

What VibeGuard checks

What your report looks like

Your app is one paste away from being safe.

Ship your app.
Not your secrets.