Your AI-built app might be leaking secrets right now. Find out in 60 seconds.
Lovable, Bolt, and v0 ship features fast — they don’t check for exposed API keys, open databases, or missing logins. VibeMoat scans your repo like an attacker and hands you plain-English fixes you paste straight back into your builder.
Your first full scan is free — no credit card, no security background required.
How it works
From repo to report in three steps
No security background required. If you can copy and paste, you can fix your app.
Connect your repo
Sign in with an emailed code and connect GitHub. We ask for the minimum read access — nothing more.
We scan like an attacker
Deterministic checks catch leaked secrets, open databases, and missing auth. Then Claude reviews your riskiest files for logic flaws.
Get a plain-English report
A letter grade, ranked findings, and for each one: what an attacker could do, and a copy-paste fix for your AI builder.
Sample report
See exactly what you’d get
Real findings, written for founders — not a wall of scary jargon.
Security report
acme-storefront
Grade
3 issues found
- Critical
Your Supabase admin key is exposed in the browser
Anyone who opens your site can read, edit, or delete every row in your database.
src/lib/supabase.ts:4
- High
Anyone can change any order’s price before paying
The checkout trusts a price sent from the browser, so a customer can pay $1 for a $100 order.
app/api/checkout/route.ts:22
- Medium
Your database table has no access rules
Row Level Security is off, so logged-in users can read each other’s private data.
supabase/migrations/0002.sql:8
Pricing
Start free. Upgrade when you ship.
One flat monthly plan covers all your apps — no per-app fees. Cancel anytime.
Free scan
One full audit, on the house.
$0
- One free full scan per account
- Plain-English report with letter grade
- Critical / High / Medium / Low findings
- Copy-paste fix prompts for your AI builder
Monitor
Stay secure as you keep shipping — every app you own.
$39/mo
All your apps · cancel anytime
- Unlimited scans across all your apps
- Automatic re-scan on every git push
- Email alert on new Critical or High issues
- Embeddable “audited” badge with your live grade
- Full scan history with new / fixed / persisting diffs
Pro
Hands-off fixes and compliance, done for you.
$99/mo
All your apps · cancel anytime
- Everything in Monitor
- Auto-generated pull requests with fixes
- Compliance pack: privacy-policy template
- Security-questionnaire answer sheet from your scan
- Priority LLM review pass
FAQ
Questions, answered
Do I need to know how to code?+
No. Every finding is written in plain English and comes with a prompt you can paste directly into Lovable, Bolt, Replit, or v0 to apply the fix.
Will you run or change my code?+
Never. We read your files in an isolated, temporary copy and delete it after the scan. We never execute your code and we never push changes unless you’re on Pro and explicitly enable fix pull requests.
Is my code safe with you?+
Your code and findings are private to your account and protected at the database level. The only place code is sent is Anthropic’s API for the review pass — and we strip any detected secrets before that ever happens.
Can you guarantee my app is secure?+
No honest tool can. Security is about reducing risk, not eliminating it. We find the common, high-impact mistakes AI builders make and help you fix them fast.
What does a scan actually check?+
Leaked API keys and secrets, exposed databases and misconfigured Supabase RLS, missing authentication, prices/roles trusted from the browser, dangerous code patterns, exposed admin routes, and logic-level access-control flaws.
Find out what’s wrong before an attacker does.
Your first full scan is free. Sixty seconds from now you could know exactly where your app is exposed.