Is your vibe-coded site actually secure?
AI-generated code ships fast - but often without rate limiting, security headers, or proper secret management. Run a free black-box scan to find what was missed.
What your report includes
13 automated checks across 5 security categories. Each finding includes severity level, what was found, and a specific fix recommendation.
API Key Exposure
Critical severity - highest weight
Scans HTML/JS source for hardcoded Google, AWS, OpenAI, Stripe, and other API keys. The most common vibe-coding mistake - and the most damaging if exploited.
Sensitive File Probing
.env, .git/HEAD, config.json
Probes paths that should never be publicly accessible. A single exposed .env file can leak database credentials, payment keys, and admin passwords.
HTTPS & Transport Security
Redirect, HSTS, mixed content
Verifies HTTP to HTTPS redirect, HSTS header enforcing encryption for future visits, and mixed content (HTTP resources that break security on HTTPS pages).
Security Headers
CSP, X-Frame-Options, COOP +3
Checks for Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each absent header is an exploitable gap.
Auth, CORS & Cookies
Admin panels, CORS, cookie flags
Probes common admin panel paths, tests CORS policy for wildcard origins, and checks cookie HttpOnly/Secure/SameSite flags that prevent session hijacking.
Client-Side Code Risks
Deps, XSS, rate limiting
Detects known-vulnerable library versions (jQuery, Bootstrap, AngularJS), reflected XSS patterns, insecure form submissions, and absent rate-limiting headers.
Security scan in 4 steps
No server access, no credentials, no code changes. Paste your URL and get a full black-box security report in under 20 seconds.
Enter your URL
Paste any public URL - your homepage, a landing page, or an API endpoint. You must own the site or have explicit permission.
We run 13 checks
Secrets in source code, sensitive file paths, HTTPS config, security headers, CORS, cookies, admin panels, and vulnerable libraries.
Get your security score
Instant 0-100 score with severity labels (Critical/High/Medium) for each finding - so you know what to fix first.
Fix with precision
Each finding includes a specific fix instruction. Email the report to your developer or share it with your hosting provider.
How scoring works
Secrets and exposure carry the highest weight because an exposed API key or .env file is an immediate, exploitable vulnerability - not a configuration best practice.
Grade bands
Secure (85 to 100 pts)
No critical or high issues found. Minor hardening opportunities may exist.
Generally Secure (65 to 84 pts)
No secrets exposed. Some security headers or transport settings need attention.
Needs Hardening (40 to 64 pts)
Multiple medium or high severity issues are present. Prioritise before launch.
High Risk (0 to 39 pts)
Critical vulnerabilities detected - exposed secrets, open admin panels, or missing HTTPS.
Category weights
| Category | Points | Weight |
|---|---|---|
| Secrets & Exposure | 30 pts | 30% |
| HTTP Security Headers | 20 pts | 20% |
| Transport Security | 20 pts | 20% |
| Authentication & Access | 20 pts | 20% |
| Client-Side Code | 10 pts | 10% |
Grade thresholds differ slightly from other tools (C starts at 40, not 45) to reflect that a single critical security finding should drop a site below the "good" threshold.
Frequently asked questions
Everything you need to know about the Vibe Check security scanner.