Pricing

Your AI shipped the app.
Did it ship your keys too?

A plain-English security check for apps built with Cursor, Claude Code, Lovable, Bolt and Replit. Leaked secrets, open Supabase tables, vulnerable packages, each with a fix prompt you paste back into your AI.

Get a Preflight Report: $29 with EARLYBIRD Free guardrail pack
Powered by open-source scanners: gitleaks · Semgrep · npm audit · OSV-Scanner · Supabase RLS checks

What the report checks

🔑 Secrets
  • API keys and tokens in code and git history
  • Supabase service_role or Stripe keys in frontend code
🗄️ Database
  • Tables without Row Level Security
  • USING (true) policies
  • Public storage buckets
🧩 Code & deps
  • Injection, missing auth patterns (Semgrep)
  • Known-vulnerable packages (npm audit, OSV)
  • Missing security headers, exposed /.env or /.git on your live URL

Pricing

Guardrail Starter Pack
Free
  • AGENTS.md + CLAUDE.md security rules
  • Cursor rules (.cursor/rules)
  • gitleaks pre-commit hook
  • 10-point pre-ship checklist
Get the free pack
Guardrail Pro Pack
$19 one-time
  • Everything in Starter
  • Stack editions: Next.js + Supabase, Node, Godot
  • Claude Code hooks that block destructive commands
  • GitHub Actions CI: gitleaks + Semgrep + npm audit
  • RLS policy templates and fix-prompt library
Buy Pro Pack
Preflight Security Report
$39 · $29 with code EARLYBIRD (first 20)
  • Repo plus optional live URL and Supabase checks
  • Ranked Critical / High / Medium findings
  • Copy-paste fix prompt for every finding
  • Delivered within 24 hours
  • 7-day refund if it's not useful

After checkout, reply to the receipt email with your repo URL (public or invite access) and live URL.

Get my report

Bundle: Report + Pro Pack for $49 · Buy bundle

Get the newsletter

Weekly notes on shipping vibe-coded apps safely: security fixes, AI coding guardrails, and tools.

Subscribe free
Not a pentest. VibePreflight is an automated, best-effort review using open-source tools and AI. It is not a penetration test, audit, or guarantee of security, and it may miss issues or report false positives. We never execute your code, we use read-only access, and we delete your code within 7 days. You remain responsible for your application.