Vibe App Security Scanner — User Guide
NordicPulse AI tool for security scanning of apps built with AI coding tools like Cursor, Bolt, Lovable, and Windsurf.
What is Vibe App Security Scanner?
Vibe App Security Scanner analyzes your deployed app for common security issues that arise when apps are built quickly with AI coding tools. The tool scans for:
- Exposed API keys in JavaScript bundles (Stripe, OpenAI, Supabase service_role, Firebase, AWS, and 15+ others)
- HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
- Supabase Row Level Security (RLS) — tests if unauthenticated calls can read data
- Information disclosure (source maps, unsafe innerHTML, exposed environment variables)
After scanning, Gemini AI generates a remediation report with actionable fixes and code examples.
How to use the tool
1. Enter the URL
Enter the full URL of the app you want to scan, e.g. https://my-app.vercel.app. The app must be publicly accessible (deployed).
2. Start the scan
Click Start security scan. The scan typically takes 10-20 seconds and consists of five phases:
- Fetching page and detecting tech stack
- Scanning JS bundles for exposed keys
- Checking HTTP security headers
- Testing database access (RLS)
- Generating security report
3. Read the results
The report shows:
- Overall risk level (Critical / High / Medium / Low / Minimal)
- Tech stack detected from the app
- Findings grouped by severity with evidence and remediation steps
- Strengths — things the app does right
Understanding the results
Severity levels
| Level | Meaning | Example |
|---|---|---|
| Critical | Immediate risk of data breach or abuse | Exposed OpenAI API key, RLS disabled |
| High | Serious security risk | Hardcoded secrets, missing authentication |
| Medium | Should be fixed, but not urgent | Missing CSP header, no X-Frame-Options |
| Low | Room for improvement | Source maps in production, missing nosniff header |
Categories
- API Keys & Secrets — Keys found in client-side JavaScript
- HTTP Security Headers — Missing or misconfigured headers
- Database Security — Supabase RLS issues
- Authentication — Cookie security, XSS patterns
- Information Disclosure — Source maps, exposed environment variables
Cost
40 credits per scan. Includes:
- HTML fetching and tech stack detection
- Scanning up to 15 JavaScript bundles
- Supabase RLS testing
- Gemini AI-generated remediation report
Data integrity
- We only scan publicly accessible information
- We do not log in, modify data, or store the keys we find
- All scanning happens server-side via a Supabase Edge Function
- Results are not stored on the server — only in your browser during the session
Tips
- Scan before launch — Run a scan before sharing the app with customers or users
- Fix critical findings first — Exposed API keys and RLS issues are highest priority
- Use the remediation suggestions — Each finding includes concrete code examples you can copy
- Scan regularly — New features can introduce new security vulnerabilities
- Check VITE_ variables — All
VITE_-prefixed variables are visible in the browser
Related tools
- Agent Security Scanner — Security audit for AI agents and MCP servers
- AI Crawler Health — Check if AI crawlers can access your website
- Site Audit — Full SEO and technical audit of your website
- Accessibility Audit — WCAG 2.1 AA accessibility check
Last updated 2026-03-21