Launch check
About to launch a vibe-coded app? Read what every visitor downloads.
Your agent built it and it works. Before strangers open it, read what their browsers will get: the page, its scripts, its headers. A Supabase service-role key or an API key in that bundle is every visitor’s key — and it is the way generated apps have actually been taken down.
What this is, and is not
It requests only what the page hands out to any visitor: the HTML, the scripts it names on its own origin, and the source maps those scripts name. It guesses no paths, probes no API, logs into nothing, and stores nothing. Third-party scripts are counted and skipped — an analytics vendor’s bundle is not yours.
It cannot see server-side code, and it cannot tell whether your database tables have row-level security — that lives in the migrations. Connecting the repository reads those, points each finding at its source line, and files or opens the fix. The same deterministic read runs there; this page is the half of it a stranger can already do.
Not deployed yet? The CLI reads the same two leaks from source, on your machine, before the deploy that would expose them.