Sieve for Mac
Your local security dashboard.
See dependency vulnerabilities and exposed credentials in one place, with severity counts and changes since your last check.
See what your app exposes to the public internet
Paste your live URL. VibeScan checks for exposed keys, open Supabase tables and missing auth in about 30 seconds. No GitHub access.
Not deployed yet?
Supabase table users is readable and writable without sign-in
The anon key in your JavaScript bundle can read and change every row. Row Level Security is off for this table.
Enable RLS on public.users and add a policy so a signed-in user can only select and update their own row.
Example, not a prevalence claim.
No repo access
Checks the live surface, the same way an attacker would see it.
Built for AI-generated apps
Open RLS policies, inverted auth and keys left in the bundle.
Fixes you can paste
Each finding comes with a prompt for Lovable, Bolt, Cursor or Claude.
Fast first-pass review. Not a penetration test. Checks the public surface and artifacts you provide. Cannot prove your app is fully secure. See our research on AI-built app vulnerabilities
AI tools generate code fast. The security gaps they leave behind are systematic — the same patterns appear across Lovable, Bolt, Cursor, and Claude-built apps. VibeScan checks for the most common ones without requiring access to your source code.
VibeScan's first 61 completed scans found 14 critical findings, including live Stripe secrets and Twilio credentials in public JavaScript. VibeScan fetches your deployed bundle, scans for credential patterns, and decodes JWTs to check for privileged roles.