Build with your agent. Check what is live.
Start with a free passive scan. Find exposed credentials and risky web configuration. Give your coding agent the evidence, deploy your repair, and use a scoped recheck for supported header findings.
- Pas dâinscription
- 230+ passive checks per scan
- Conscient du BaaS
- SĂ»r pour lâauth (passif)
FixVibe is a security scanner for indie developers and small teams shipping web apps built with AI coding tools such as Lovable, Bolt, v0, Cursor and Claude Code. Paste a deployed URL to find exposed Supabase service-role keys, missing Row-Level Security, open Firebase rules, secrets in JavaScript bundles and weak headers. The passive scan is free.
How it fits your workflow
Your agent repairs it. Recheck the deployed header.
Start with a precise result you can inspect. The first verification pilot checks whether a supported x-content-type-options finding has been repaired on the same deployed page. Your agent makes the change; FixVibe measures the follow-up response.
This workflow example is currently available in English.
- 01
Inspect the deployed app
Run an authorized passive URL scan. A new supported header finding can provide the baseline for a scoped recheck. Review the report's evidence and any checks that could not run.
- 02
Repair in your existing workflow
Open the finding's fix-and-recheck options. Give the repair guidance to Claude, Codex, or your preferred agent, review its change, and deploy through your normal workflow.
- 03
Deploy, then request verification
See whether the expected header is present on a comparable response. The result can confirm this scope, report the issue still present, or stay inconclusive when a reliable comparison is not possible.
Synthetic example · not a customer report
Before: x-content-type-options is missing. After a comparable recheck: x-content-type-options: nosniff.
Illustrative result: âVerified for this page and header.â The report keeps the baseline, the later measurement, and any remaining responsibilities visible.
This pilot verifies one header on the same page's anonymous response. Other pages, signed-in roles, credential revocation, and unrelated vulnerabilities remain outside that result. It is not an app-wide security certificate.
Free reports show a top-two preview. For one eligible finding, the browser introduction includes repair guidance and one verification within seven days, plus one additional attempt after an inconclusive result. Full reports and API/MCP require a paid plan; scheduled scans require Pro or Unlimited.
Couverture du scanner
- 240+
- classes de vulnérabilités couvertes
- 230+
- checks passifs / scan
- 130+
- checks actifs / scan
- 190+
- checks GitHub / scan
Compatible avec
A security check alongside your coding agent.
Coding agents can review and test security. FixVibe adds maintained checks, deployed-app evidence, and repeatable reports to your workflow. URL scans, eligible GitHub scans, and paid MCP access each have their own scope.
- Cursor
- Claude Code
- OpenAI Codex
- GitHub Copilot
- Lovable
- Bolt.new
- v0
- Replit Agent
- Windsurf
- Devin
- Google Jules
- Gemini CLI
- Firebase Studio
- Amazon Q Developer
- JetBrains Junie
- Kiro
- Tabnine
- Qodo
- Sourcegraph Amp
- Continue
- Cline
- Roo Code
- Aider
- OpenCode
- Base44
- Anything
- Builder.io Fusion
- Tempo
- Softgen
- Trae
Guides
Secure your AI-built app.
- Sécurité BaaS
Scanner RLS Supabase : détecter les tables avec sécurité au niveau des lignes absente ou défaillante
La sĂ©curitĂ© au niveau des lignes (RLS) est la seule chose qui se tient entre les donnĂ©es de vos clients et Internet lorsque vous mettez en ligne une application adossĂ©e Ă Supabase. Les outils de codage IA gĂ©nĂšrent du code en forme de RLS qui compile, est livrĂ© et fuit silencieusement des donnĂ©es â tables crĂ©Ă©es sans RLS activĂ©, politiques qui lisent mais ne restreignent jamais, prĂ©dicats qui comparent une colonne Ă elle-mĂȘme. Cet article montre ce qu'un scanner RLS Supabase peut prouver depuis l'extĂ©rieur, les quatre formes de RLS dĂ©faillante qui apparaissent dans les applications vibe-codĂ©es et comment scanner votre propre dĂ©ploiement en moins d'une minute.
- Sécurité BaaS
Clé de rÎle de service Supabase exposée en JavaScript : ce que cela signifie et comment la trouver
La clĂ© de rĂŽle de service Supabase est la clĂ© maĂźtresse de votre base de donnĂ©es. Quiconque la dĂ©tient contourne la sĂ©curitĂ© au niveau des lignes, peut lire chaque colonne de chaque table et peut Ă©crire ou supprimer ce qu'il veut. Elle est conçue pour vivre exclusivement dans le code cĂŽtĂ© serveur â jamais dans le navigateur. Lorsqu'un outil de codage IA la livre dans le bundle JavaScript, votre base de donnĂ©es est, en effet, publique. Cet article explique la forme du JWT qui identifie une clĂ© fuitĂ©e, les trois motifs d'outils IA qui produisent la fuite, ce qu'il faut faire dans la premiĂšre heure aprĂšs dĂ©tection, et comment scanner automatiquement avant les utilisateurs.
- Sécurité BaaS
Scanner de rĂšgles Firebase : trouver les rĂšgles ouvertes dans Firestore, Realtime Database et Storage
Les applications Firebase Ă©chouent en sĂ©curitĂ© d'une maniĂšre cohĂ©rente : des rĂšgles allow read, write: if true; laissĂ©es par le dĂ©marrage rapide en mode test, jamais remplacĂ©es avant la production. Les outils de codage IA gĂ©nĂšrent ces rĂšgles textuellement Ă partir des exemples de la documentation et invitent rarement le dĂ©veloppeur Ă les durcir. Cet article montre comment un scanner de rĂšgles Firebase dĂ©tecte les rĂšgles ouvertes Ă travers Firestore, Realtime Database et Cloud Storage depuis l'extĂ©rieur du projet â et comment corriger ce qu'il trouve.
- Guides de sécurité
La checklist de sécurité vibe coding : 51 items avant le déploiement
Une liste de contrĂŽle pratique et organisĂ©e par phases pour les applications crĂ©Ă©es avec Cursor, Claude Code, Lovable, Bolt, v0, Replit et Windsurf. Chaque Ă©lĂ©ment est exploitable en moins de cinq minutes. Parcourez-le avant de passer en production, puis Ă nouveau avant chaque version majeure. Les Ă©lĂ©ments sont regroupĂ©s en sept catĂ©gories (secrets, base de donnĂ©es, authentification, en-tĂȘtes, tiers, dĂ©ploiement, surveillance) et Ă©tiquetĂ©s avec la phase de dĂ©ploiement Ă laquelle ils s'appliquent.
- Guides de sécurité
Lovable security checklist: 25 items before launch
Lovable is a fast path from idea to a published full-stack app on Supabase and Vite. This checklist targets the risks that come with that stack: RLS that must be enabled and tightened on every table Lovable creates, test keys from integrations, import.meta.env leaking env vars into the Vite bundle, GitHub sync exposing secrets, and missing security headers. 25 items across secrets, database, auth, headers, deployment, and Lovable-specific gotchas.
- Guides de sécurité
Bolt.new security checklist: 23 items before ship
Bolt.new (StackBlitz WebContainer) runs your dev environment in the browser, generates full-stack JS in minutes, and publishes to Bolt hosting by default or to Netlify (Bolt docs). This checklist targets Bolt-specific risks: secrets that were safe in the dev container leak once the project is exported, Express CORS defaults are permissive, session cookies need explicit HttpOnly flags, and credentials pasted into the terminal or chat are hard to take back. 23 items across secrets, database, auth, headers, deployment, and Bolt-specific gotchas.