Vibe coding security scanner — free check for your AI-built app

If you’ve shipped an AI-built app and you want to know what’s actually exposed, you have a few options. You can read the code yourself, which works if you can read the code. You can ask another AI to audit what the first AI wrote, which helps but is susceptible to the same confidence-without-correctness problem you were trying to escape. Or you can use a scanner that looks at your live app from the outside, the way an attacker would.

This page is the third option. It’s also free. There’s no upsell to a pro plan. There’s a paid tier for full reports and rescans, but the scan itself — finding out whether your AI-built app has any of the seven common issues — costs nothing.

What the scanner checks

Right now, in under two minutes, against your live URL:

• Secrets in your bundle. We download your deployed JS and look for the patterns that indicate a leaked Supabase service role key, OpenAI key, Stripe secret key, hard-coded JWTs, and a handful of other common leaks.
• Exposed config files. .env, .env.local, .git/config, wp-config.php, phpinfo.php, .DS_Store, and the other files AI tools sometimes deploy by mistake.
• Open database endpoints. If your app uses Supabase or Firebase and you’ve left tables without proper row-level security, we detect that by attempting a read with an anonymous client and seeing if you get data back.
• Admin pages. We probe the obvious URLs (/admin, /dashboard, /internal, framework-specific equivalents) and check whether they return HTML and data, or correctly redirect to a login.
• Source maps in production. Whether your build is shipping .js.map files that hand attackers your original source.
• Security headers. HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. We grade what’s there and tell you what isn’t.
• DNS posture. Subdomain takeover candidates, SPF/DKIM/DMARC gaps, suspicious dangling records.
• SEO and launch polish. Title, meta description, sitemap, robots, Open Graph, lang attribute, 404 behaviour. The boring stuff that decides whether anyone finds you.
• Lighthouse-style scores. Performance, Accessibility, Best Practices, SEO. Plus compression, cache headers, HTTP/2/3.

That’s the outside scan. It’s safe to run on a live product — we don’t authenticate, we don’t load-test, we don’t try anything a pentest could break. We look at what your app exposes to the public internet and nothing else.

What you get

The free scan tells you the headline number. How many critical issues, how many medium, how many things to review. You see the count before you ever commit money.

If there’s nothing to fix, you don’t pay. We tell you you’re in good shape, and that’s the end of it.

If there is something to fix, you can buy the full report for $49. That includes every finding with evidence (the file, URL, or config we found it in), severity, a one-line “why this matters,” and — the part that makes Patchable different — a paste-ready fix prompt for Claude Code, Cursor, Bolt, or whatever AI tool you build with. Hand the prompt to your AI, the fix lands. One paste, one PR.

We wrote more about how the paid tiers work on the home page. The summary: $49 for the outside scan, $149 for an in-depth codebase audit that runs locally in your coding agent (your code never reaches our servers), $499 for the enterprise tier with compliance and sales packets included.

Why “free to scan” isn’t a gimmick

A lot of “free scan” tools online are loss leaders for a $5,000/year enterprise contract. That’s not what’s happening here. The free scan is the product. We charge for the report — because the report includes the fix prompts, which is what saves you the actual hours. The scan itself takes our servers ten seconds. It’s not the costly part.

The reason we lead with “free to scan” is that nobody wants to pay $49 to find out their app is fine. The risk-reversal is the point: you only pay when there’s evidence the spend is worth it.

Run the scan

Scan your AI-built app — takes under two minutes.

If you’d rather read first, the vibe coding security guide walks through every check the scanner runs, and explains what each fix looks like.

Related reading

• The vibe coding security guide — the long-form explainer.
• Vibe coding security risks — the 7 specific things we find.
• Vibe coding with Claude — Claude-specific patterns.
• Vibe coding with Cursor — Cursor-specific patterns.
• Is your Lovable app secure? — Lovable-specific checklist.
• Vibe coding with Replit Agent — Replit-specific issues.