The security and legal scanner for apps built with AI. Paste your URL and we’ll lick your vibe-coded app clean: every legal gap and security hole, in plain English, with a fix prompt to paste straight back into your AI.
Examples: A secret key is visible in your page source. Missing privacy policy. Your site always loads over HTTPS. No cookie consent, but you're tracking visitors. Clickjacking possible: others can embed your site. No private config files are downloadable. Your cookies are missing their safety settings. Screen-reader basics are in place.
Three steps. One of them is pressing paste.
1
Paste your URL
Live site or a preview link. A free account, nothing to install or configure.
2
We take a good look
We open your site in a real browser and watch: what loads before anyone clicks, which cookies land, what your JavaScript files give away, across up to nine pages. 38 checks, about a minute.
3
Paste the fixes back
Every problem comes with a prompt written for your AI coding tool. Copy, paste, re-scan, watch the grade climb.
F
example.com
3 / 100
The http:// version doesn't redirect to HTTPS
No rules about which scripts can run on your site
Clickjacking possible: others can embed your site
Couldn't find a privacy policy
No secret keys found in your page source
No private config files are downloadable
A real scan of example.com, the internet’s official demo site. 6 of 38 results shown.
This is what comes back.
A grade you can read in a second, problems sorted by how much they can hurt, and the things you got right, because there are always some. Even a one-page demo site gets caught out.
Your AI built it fast. Here’s what it skipped.
Keep scrolling. This is what fixing it looks like.
Security
The stuff bots try on every new site, all day.
A secret key is visible in your page source
Private config files are downloadable
Clickjacking possible: others can embed your site
Your site can be loaded without encryption
Your cookies are missing their safety settings
Your original source code is downloadable
A secret key is visible in your page source
Private config files are downloadable
Clickjacking possible: others can embed your site
Your site can be loaded without encryption
Your cookies are missing their safety settings
Your original source code is downloadable
Legal
What regulators, app stores and payment providers expect to see.
Other scanners hand you homework. We hand you the exact words to paste into the tool that built your site, written so it works out your framework on its own.
Anyone can press 'View source' and copy this key, then run up your bill or read your database. Bots scan for exactly this, all day.
What we saw
Stripe secret key: sk_l…9J0x
Read the fix prompt
A secret key is exposed in my site's public HTML/JavaScript. Do this in order: 1) find every place the key appears in my codebase, 2) move it to a server-only environment variable (no NEXT_PUBLIC_ / VITE_ prefix) and call that API from a server route or function instead of the browser, 3) remind me to ROTATE the key in the provider's dashboard because it's already leaked, 4) check git history and tell me if it was committed. Show me each file you change.
Every report comes with a badge for your footer. It shows your grade, your score and the month you were scanned, and it links to the live report so anyone can check. Score an A or a B and it sticks its tongue out. Anything less, it doesn’t. That part you have to earn.
Seal or footer bar, dark or light. One line of HTML, no script, nothing that slows your site down.
AI tools build what you ask for, and nobody asks for security headers or a privacy policy. Twelve checks to run before you share the link.
7 min read
Fair questions
What does it cost?
Scanning is always free with an account and shows your grade and every problem in plain English. Your first report is fully unlocked, fix prompts and all. After that, unlocking a report is a one-time $9: every fix prompt, a single fix-everything prompt, a comparison with your last scan, and a downloadable report. No subscription. Payments are handled by Dodo Payments; we never see your card.
Is this legal advice?
No. We look for the things lawyers and regulators usually expect to see, like a privacy policy or a cookie banner, and tell you when we can't find them. Treat it as a checklist from a careful friend, then have anything important reviewed by a professional.
Do you store my site?
We never keep your pages. We fetch them, run the checks, and keep only the report: the findings, the score and your URL. Any secret we spot is masked before it's saved, so the report never contains the full key.
Does it work on localhost?
No. The scan runs from our servers, so your site has to be on the public internet. A preview or staging URL from Vercel, Netlify or Lovable works fine.
What tools do the fix prompts work with?
Anything that takes instructions in plain English: Claude Code, Cursor, Lovable, Bolt, v0, Replit, Copilot. Each prompt tells the AI to work out your framework from your code, so you don't have to know what you're running.
What can't you see?
Anything behind a login, and anything that only happens after someone clicks, types or pays. We open your site in a real browser and visit up to nine of your pages, but we never click buttons, fill in forms or sign in. If your site uses bot protection that blocks our browser, we fall back to a basic scan and tell you.
Will the scan hurt my site?
No. It loads up to nine of your pages once each, like one curious visitor with a browser. It never submits a form, logs in, or repeats requests to test your limits. Our crawler identifies itself as vibeliq-scanner so you can spot it in your logs.
