Your vibe-coded app probably has security holes. We find them. We fix them.
VibeDefend watches your Lovable, Replit, Bolt, or v0 app for security problems and sends you a "fix this" message in plain English — with the fix already written. No security background required.
Move Supabase service-role key out of the client
Your Supabase service-role key is shipped to every visitor's browser. Anyone can read or delete every row in your users table.
Moved the key to a server-only env var. The browser now uses the safe anon key, which RLS will gate.
1 import { createClient } from '@supabase/supabase-js' 2 3- export const supabase = createClient( 4- "https://abc.supabase.co", 5- "eyJhbG...service_role..." // ⚠ leaked 6- ) 3+ export const supabase = createClient( 4+ import.meta.env.VITE_SUPABASE_URL, 5+ import.meta.env.VITE_SUPABASE_ANON_KEY 6+ )
Where VibeDefend sits in your stack.
Your app lives on GitHub. We're a GitHub app that watches it. When we find a problem, we send you a fix as a pull request. Nothing in your code changes until you click Merge.
your-app
github.com/you/repo
VibeDefend AI
tuned for vibe-coded apps
You choose which repos we can read. We can't see anything else in your GitHub account. Ever.
We read it, scan it, then delete it — every single time. Nothing about your code lives in our database.
Anthropic's Claude API doesn't use your code to train models. Your code is yours.
From your push to a finished fix — in about 10 seconds.
Here's what happens between the moment you save your work and the moment a "fix this" message appears in your repo. The middle part — that's all us.
You push to GitHub
Save your work
We scan your code
Find security issues
We explain it
In plain English
We write the fix
A tiny code change
We double-check it
Fix must actually work
We send it to you
As a pull request
You click Merge ✓
Total time · ~10 seconds
What you have to do — basically nothing.
You connect us once. We do the rest in the background. The only time you'll touch anything is when you click "Merge" on a fix.
✓ Connected to github.com/you
✓ Watching your-app
that's it — done
Connect VibeDefend to your app.
Click Install on GitHub, pick which apps you want us to watch, done. We never see anything you didn't pick.
2 min ago · in your repo
● Hey, your Supabase key
is showing in your app.
We send you a plain-English message.
You'll see a message in your repo that says "here's what's wrong, here's what could happen, here's the fix." Written like a human, not a security report.
✓ Your tests passed
✓ Fix already written
→ [ Merge ]
Click "Merge" if you want the fix.
Or don't — nothing in your app changes until you approve it. Your tests run first, so you'll know if anything breaks before you decide.
The generator made you an app.
It didn't make it safe.
The stuff that actually gets indie founders in trouble.
30+ curated rules tuned for Lovable, Replit, Bolt, and v0 templates. Updated weekly as new patterns surface.
Exposed API keys
Supabase, Stripe, OpenAI, Anthropic, AWS keys hiding in your client bundle.
Open databases (RLS off)
Supabase tables with Row-Level Security off. Anyone on the internet can read everything.
Missing auth checks
API routes anyone on the internet can call without a session.
// no auth check
return users
}
XSS via dangerouslySetInnerHTML
User input lands in your HTML unescaped — comment, bio, username.
__html: userBio }} />
CORS wildcards
Allow-Origin: * + credentials = any site can act as your user.
Committed .env files
Secrets pushed straight to GitHub. Removing alone doesn't help — git history keeps everything.
STRIPE_SECRET_KEY=sk_live_xxx
Logged auth tokens
Auth tokens printed in production browser console. Visible to dev tools, extensions, bots.
And 20+ more rules
Open redirects, prototype pollution, regex DoS, vulnerable deps, missing CSRF, SQL injection via raw queries.
// Bolt, v0 — updated weekly
Rules are tuned for your stack — not generic enterprise noise. Don't see one you'd want? Tell us.
Built for vibe-coders.
Not for security teams.
Pay per project — not per developer.
Free first scan, top-3 findings shown to free tier. No auto-fix without a paid plan.
For one app you actually care about.
- +1 project
- +Scans on every push
- +Auto-fix pull requests
- +Email alerts
For one app that's making money.
- +Everything in Starter
- +Continuous URL monitoring
- +Slack & Discord alerts
- +Priority model for fixes
For builders shipping for clients.
- +Up to 5 projects
- +White-label PR comments
- +Team seats
- +Priority support
Free forever · scan + top 3 findings · no auto-fix · Annual prepay saves 20%
What people actually ask.
Will VibeDefend break my app? +
No. Every patch must pass our scanner on the patched code before we open a PR. PRs are opened as drafts — your CI runs first. You merge, we don't.
Does it work if I didn't use Lovable, Replit, Bolt, or v0? +
Yes, but our rules are tuned for those stacks first. Plain Next.js + Supabase still gets value. A 200-file Rails monolith — not our target user yet.
Can I scan private repos? +
Yes, including on the free tier (1 repo). We never persist your code beyond a single scan — clone, scan, delete.
Do you train models on my code? +
No. We send snippets to Anthropic's Claude API to generate explanations and patches. Anthropic does not train on API traffic — your code never lands in a training set via us.
What if a finding is wrong? +
Reply /vd false-positive on the PR. We use it to tune our rules. False positives below 5% is a hard product goal.
What if Lovable / Replit / Bolt build this themselves? +
Possible. We're shipping first, getting good at this, and earning the brand with the persona. Worst case — you got a free year of scans while it lasted.