SniffPupVibe coding security scanner for apps built with AI
Last updated · By Ember, SniffPup
Built your app with Lovable, Bolt, Cursor, Replit or v0? Paste the live URL. SniffPup checks what your published site shows to any visitor, passively and read-only, and explains each issue in plain English with a fix prompt you can paste back into your AI tool.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. Results cover your whole published site: secret keys, public files, Supabase and Firebase exposure, headers, cookies and HTTPS. The free report lists every issue it finds with its severity, plus the full fix free for every critical issue (with no critical, one other fix). Only scan sites you own or are authorized to test. What the scanner does and never does.
What this checks
- Secret keys in your shipped HTML and JavaScript, such as OpenAI, Stripe and Supabase
service_roleorsb_secret_keys. Any key found is masked in the report. - Public files such as
/.env(variable names only, never values),/.git/configand public source maps. - Supabase and Firebase exposure: whether anonymous visitors can read your data, using only your site's public config, read-only and without reading row data.
- Security headers, cookie flags and HTTPS, including when your certificate expires.
- Outdated JavaScript libraries with known vulnerabilities, when the exact version can be read.
- Email setup and CORS: SPF, DMARC, DKIM and a reflected-Origin check.
Your site gets a 0–100 score. The free scan lists every issue by title and severity and gives the full fix for every critical issue free (with no critical, one other fix is free). The one-time $9 Full Fix Report unlocks every fix plus 30 days of re-scans; Solo monitoring is $7/mo. See pricing.
What it can't tell you
- It can't see your source code, server logic or your Row Level Security policies. Your builder's own scans and our Supabase RLS checker guide cover those.
- It doesn't log in, so pages behind sign-in aren't checked.
- It scans live web URLs only, not native mobile apps.
- A 100 score means no issues were found in our checks. It is never proof of security, and the badge isn't either.
Other good vibe coding security scanners
You may want more than one view of your app. Facts below are from each tool's own pages, checked October 21, 2026.
- ScanVibe is a passive live-URL scanner with a genuinely generous free plan: unlimited scans with all security analyzers, full results, fix instructions and an AI fix prompt. Pro ($9/mo) adds scheduled scans, email alerts and full scan history. See SniffPup and ScanVibe compared.
- CheckVibe goes beyond the live site: connect your GitHub repo and Supabase backend and it scans your code and Supabase setup too (pull request review is on its Team plans). Paid plans start at $24/mo, each with a 14-day free trial. See SniffPup and CheckVibe compared.
- Your builder's own checks are worth running first. See our guides for Lovable, Bolt and Cursor, and the best free scanners for vibe-coded apps.
A simple routine
- Run your builder's own security scan and fix the critical findings.
- Publish, then scan the live URL here.
- Fix anything new, then scan again after every big change.
Questions
What is a vibe coding security scanner?
A tool that checks an app built with AI coding tools such as Lovable, Bolt, Cursor, Replit or v0 for the security mistakes those apps often ship with: secret keys in the browser, public .env or .git files, open database tables and missing security headers. Some scan your live URL, some scan your code, and some do both.
Is SniffPup's vibe coding security scanner free?
Yes. The free scan needs only your URL, no account. It lists every issue it finds by title and severity and gives the full fix for every critical issue free; with no critical, one other fix is free. A one-time $9 Full Fix Report unlocks every fix plus 30 days of re-scans, and monitoring starts at $7/mo.
Does SniffPup need my code or a login?
No. It checks your published site from the outside, passively and read-only: about 45 requests or fewer, no logins, no exploit payloads, and it never uses a secret key it finds. That also means it can't see your source code, server logic or anything behind a login.
Does a 100 score mean my vibe-coded app is secure?
No. A 100 means no issues were found in our checks. It is never proof of security, and neither is the badge.
Which other vibe coding security scanners should I look at?
ScanVibe is a passive live-URL scanner with a generous free plan (unlimited scans with full results and fix prompts, per its pricing page). CheckVibe is a broader paid platform (from $24/mo, 14-day free trial) that can also scan your code and Supabase setup. Our comparison pages lay out the facts for each, and it's fine to run more than one.
A clean report is not a guarantee of security. Only scan sites you own or are authorized to test.