Know what your AI-built app is leaking.
Security scanning for Lovable, Bolt, v0, and Supabase apps. Find exposed keys, RLS gaps, broken settings, and cost traps — then get a fix you can actually apply. Start free, no signup.
Free surface scan
Public URL only. No keys, no signup, no credit card.
Surface scans only look at public signals. We never see your database keys.
Your users table is readable by anyone
Row Level Security is off, so anyone with your public key can read every row — including emails and private data.
Security scanning for Lovable, Bolt, v0, and Supabase apps
Public surface checks first. Connect Supabase read-only when you want database policies, auth settings, and monitoring.
Plain-English findings
Every issue says what it means, why it matters, and exactly what to change.
Fixes you can paste
SQL and config snippets, plus a ready-made prompt for Lovable, Bolt, or v0.
Watches while you sleep
Continuous read-only scans, real-time HIGH/CRITICAL alerts, and a weekly digest.
Go deeper: connect your Supabase project
A connected project unlocks database-level checks, finding history, and monitoring. Read-only OAuth — no service keys, ever.
- ✓Settings, policies, and database structure
- ✓Public pages of your app, like a normal visitor
- ✓No table contents, no user data, no writes
Connected monitoring includes
- 10 database security checks
- Scan history and diffs
- Real-time HIGH/CRITICAL email alerts
- Weekly digest of new and resolved findings
Continuous monitoring plans start at $19/mo. See pricing
Questions
The short answers to what people ask before connecting a project.
What does VibeSitter check?
VibeSitter runs a free surface scan on public pages and, when you connect Supabase, read-only database checks for RLS, exposed keys, auth settings, storage buckets, and other common issues in AI-built apps.
Does VibeSitter read my data?
No. Connected scans use read-only OAuth scopes and metadata/config checks only. VibeSitter never reads your table contents, files, or users' PII.
Does it work with Lovable, Bolt, and v0?
Yes. Every finding includes SQL/config fixes and a copy-paste prompt for the AI tool that built your app.
Do I need to paste a service key?
No. VibeSitter uses Supabase OAuth with read-only scopes. It never asks for a service-role key or database password.
How much does it cost?
The surface scan is free. Connected monitoring starts at $19/month for Sitter (one project, scans every 6 hours) and $49/month for Night Sitter (up to three projects, scans every hour).
Can I cancel or disconnect at any time?
Yes. You can disconnect a project or cancel your plan from Account, and delete your account and data at any time.