Security preflight for AI-built apps

Your AI shipped the app.
Did it ship your keys too?

A plain-English security check for apps built with Cursor, Claude Code, Lovable, Bolt and Replit. Leaked secrets, open Supabase tables, vulnerable packages, each with a fix prompt you paste back into your AI.

Get the free pack →See the Preflight Report

Free guardrail pack: AGENTS.md, Cursor rules, pre-commit hook and checklist.

SAMPLE · demo repo

$ vibepreflight scan ./demo-app › gitleaks · semgrep · osv · npm audit · rls CRITICAL Stripe access token src/server.js:6 CRITICAL service_role key in client src/client.tsx CRITICAL profiles: RLS not enabled migrations/ HIGH /admin route has no auth src/server.js:14 HIGH RLS policy USING (true) migrations/ HIGH vulnerable dep: lodash package.json MEDIUM missing header: CSP example.com … 17 more ✓ 24 findings · 4 critical · 12 high · 8 medium ✓ fix prompt generated for every finding $

Built on open-source scannersgitleaksSemgrepOSV-Scannernpm auditSupabase RLS checks

Coverage

What the report checks

The mistakes AI coding tools make most often, ranked by severity, each with a fix you can paste straight back into your assistant.

Secrets

API keys and tokens in code and git history
Supabase service_role or Stripe keys in frontend code

Database

Tables without Row Level Security
USING (true) policies
Public storage buckets

Code & deps

Injection, missing auth patterns (Semgrep)
Known-vulnerable packages (npm audit, OSV)
Missing security headers, exposed /.env or /.git on your live URL

Pricing

Start free. Go deeper when you ship.

One-time prices. No subscriptions.

Guardrail Starter Pack

Free

AGENTS.md + CLAUDE.md security rules
Cursor rules (.cursor/rules)
gitleaks pre-commit hook
10-point pre-ship checklist

Get the free pack

Guardrail Pro Pack

$19 one-time

Everything in Starter
Stack editions: Next.js + Supabase, Node, Godot
Claude Code hooks that block destructive commands
GitHub Actions CI: gitleaks + Semgrep + npm audit
RLS policy templates and fix-prompt library

Buy Pro Pack

Recommended

Preflight Security Report

$39 · $29 with code EARLYBIRD (first 20)

Repo plus optional live URL and Supabase checks
Ranked Critical / High / Medium findings
Copy-paste fix prompt for every finding
Delivered within 24 hours
7-day refund if it's not useful

After checkout, reply to the receipt email with your repo URL (public or invite access) and live URL.

Get my report

Bundle: Report + Pro Pack for $49 · Buy bundle →

After you order, we email you from hello@vibepreflight.com. If you don't see it within a few minutes, check your spam or junk folder and mark it Not junk.

Not a pentest. VibePreflight is an automated, best-effort review using open-source tools and AI. It is not a penetration test, audit, or guarantee of security, and it may miss issues or report false positives. We never execute your code, we use read-only access, and we delete your code within 7 days. You remain responsible for your application.