Only scan websites and apps that you own or have explicit permission to test.
VibeCheck performs passive, read-only checks: it loads your public pages, JavaScript files, robots.txt and sitemap.xml, follows up to 20 internal links, and reads response headers. It never logs in, submits forms, brute-forces or attempts exploits.
If a Supabase project and its public anon key are visible in your site's code, we make read-only requests (limit=1) to a small list of table names to check whether they're publicly readable. We report table names only. Row data is discarded immediately and is never stored or displayed.
Detected secrets are masked in reports. Reports are encoded in the share link itself; we keep no database of scans. Basic request logs may be kept by our hosting provider.
Requests are rate-limited per IP. Abuse (scanning third-party sites without permission, automated mass scanning) is prohibited.
Results are provided "as is" without warranty. A good score does not guarantee your app is secure.