A free, passive security scan for AI-built websites — catches the exposed keys, missing headers, and leaked files that AI page builders commonly leave behind.
Scan a site or a list of pages for the security issues that AI-generated ("vibe-coded") sites commonly ship with — hardcoded API keys, missing security headers, exposed .env/.git files, vulnerable JS libraries, and verbose error pages.
Passive checks only — no exploitation, no injection, no authentication attempts.
Three simple steps to a passive security report for any website you own or manage.
Paste a single page URL, or switch to bulk mode and paste up to 15 URLs — your homepage, dashboard, app pages, whatever you want checked.
We fetch what your site already serves publicly — the page, its response headers, linked scripts, and a handful of well-known paths. Nothing is injected, exploited, or authenticated against.
Every issue found comes with a concrete, copy-pasteable fix — not just a warning. Export to PDF, CSV, or JSON.
Purpose-built checks for the exact mistakes AI page builders tend to make.
Scans page source and linked scripts for hardcoded OpenAI, Stripe, AWS, Google, and Slack keys, private key blocks, and database connection strings.
Decodes JWTs found in your bundle and flags any with a service_role claim — the single most common critical leak in Supabase-backed vibe-coded apps.
Checks whether your environment file, git history, or unminified source maps are accidentally being served to the public.
Checks Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy, and CORS configuration against best practice.
Fingerprints common libraries (jQuery, Lodash, Moment.js, Bootstrap, AngularJS) and flags known-vulnerable versions with the relevant CVE.
Requests a nonexistent path and checks whether your site leaks a stack trace or debug error page instead of a clean 404.
AI page builders optimize for a working feature, not a secure one — the two most common results are secrets that leaked into the client bundle, and security headers nobody thought to add.
Tools like v0, Bolt, Lovable, and Replit Agent are optimized for shipping a working feature fast — not for knowing which values must never reach the browser.
A leaked Supabase service-role key bypasses every Row Level Security policy. A leaked database connection string is direct, authenticated access to your data.
A secret hardcoded in client-side JavaScript isn't "hidden" by minification — anyone can view-source or open devtools and read it in seconds.
Security headers like CSP and HSTS cost nothing to add and meaningfully raise the bar against XSS, clickjacking, and downgrade attacks.
Deleting a secret from your latest commit doesn't remove it from git history — if .git is exposed, every past commit is readable too.
Purpose-built for the specific mistakes AI-generated apps tend to make, not a generic decade-old scanner checklist.
General-purpose scanners check headers. This one is built specifically for what vibe-coded apps get wrong.
| Feature | AI Ranko | Mozilla Observatory | SecurityHeaders.com | OWASP ZAP |
|---|---|---|---|---|
| Free to use | ||||
| No signup required | ||||
| HTTP security header analysis | Partial | |||
| Exposed API key / secret detection | ||||
| Supabase / JWT service-role key detection | ||||
| Exposed .env / .git / source map detection | Requires config | |||
| Vulnerable JS library detection | Requires config | |||
| Bulk URL scanning | Requires setup | |||
| Every issue paired with a fix | Partial | |||
| CSV / JSON / PDF export | Partial | |||
| No install required |
"Vibe coding" — building an app mostly by prompting tools like v0, Bolt, Lovable, Replit Agent, or Cursor rather than writing code by hand — has made it faster than ever to ship a working product. But speed comes with a tradeoff: these tools are optimized to make a feature work, not to know which values must stay on the server. The result is a predictable pattern of mistakes that shows up across thousands of AI-generated apps: a Supabase service-role key pasted directly into a client component, a database connection string left in a config file that got bundled into the frontend, or security headers nobody thought to add because the AI never suggested them.
This website vulnerability scanner is built specifically around that pattern. Instead of a generic decade-old checklist, it looks for the exact things vibe-coded apps get wrong: hardcoded API keys and secrets in page source or linked JavaScript bundles, exposed .env and .git files, missing HTTP security headers, outdated JS libraries with known CVEs, and debug error pages that leak stack traces in production.
Every check is passive and read-only— it only fetches what your site already serves publicly. Nothing here attempts to exploit a vulnerability, inject a payload, brute-force a login, or bypass authentication. It's the same category of tool as Mozilla Observatory or SecurityHeaders.com, purpose-built for the vibe-coding era, and it's completely free.
No. This scanner only performs passive, read-only checks — fetching the page you already serve publicly, reading its response headers, and checking a handful of well-known paths (like /.env). It never attempts to exploit a vulnerability, inject payloads, brute-force credentials, or bypass authentication. It's the same category of tool as Mozilla Observatory or SecurityHeaders.com, not a penetration-testing tool.
Vibe coding refers to building an app primarily by prompting an AI tool (v0, Bolt, Lovable, Replit Agent, Cursor, etc.) rather than writing code by hand. These tools are excellent at shipping working features fast, but they don't always know which values must stay server-side — so API keys, database credentials, and admin-level keys sometimes end up hardcoded directly into the client-side bundle that ships to every visitor's browser.
It checks page source and linked same-origin JavaScript files for patterns matching OpenAI API keys, Stripe secret keys, AWS access keys, Google API keys, Slack tokens, private key blocks, database connection strings with credentials, and Supabase/JWT service-role keys (which bypass Row Level Security entirely if leaked).
Yes — only scan sites you own or have explicit permission to test. The checks themselves are non-destructive and passive, but running any automated scan against a site you don't control without permission may violate its terms of service.
Yes — switch to "Multiple URLs" and paste up to 15 page URLs, one per line or comma-separated, to get a scored report across all of them.
Every check is weighted by real-world severity — an exposed .env file or a leaked service-role key weighs far more than a missing Referrer-Policy header. The score is the percentage of total weight earned across every check that applies to your page, graded Excellent / Good / Needs Work / Poor.
Completely free, no sign-up. Scans support up to 15 URLs per batch to keep results fast and reliable.