VibeAlarm

A smoke alarm for your AI-built app.

Your AI-built app can fail quietly.

VibeAlarm is a smoke alarm for the app you shipped with Lovable, Bolt, Cursor, v0, or Replit. Paste the URL. We read the public site and tell you, in plain English, what a stranger can already see.

Free check

Passive only. We download the homepage, its scripts, robots.txt, and — if a public Supabase or Firebase config is sitting there — one read to see if anonymous access is obviously open.

One click. Public pages only. We do not submit forms or log in unless you later verify the domain.

Quiet breakage

Signup, login, or checkout stops working after an edit. Founders hear about it from angry users.

Open tables

A Supabase or Firebase project answers to the anon key with no signed-in user.

Keys in the bundle

Stripe secret keys, cloud tokens, and private keys sitting in public JavaScript.

A site that is just down

The homepage, the certificate, or the headers that keep a browser from being tricked.

How monitoring works

  1. 1. Free check

    See the public report before you make an account.

  2. 2. Prove the domain

    DNS TXT, a meta tag, or a file. No active tests before that.

  3. 3. Record a flow

    Visit, fill, click, expect text. Use a test login, not a real customer.

  4. 4. We watch

    A schedule reruns the checks and emails you when something that passed now fails.

Daily checks

Monitor

$19/mo

One app, checked every day. Passive scan plus the flows you record.

1 app

Start with an account

Daily checks

Watch

$49/mo

Five apps, checked every day, plus a weekly pass for leaked keys.

5 apps

Start with an account