No. The scan runs in your browser and nothing is sent to a server.

What does the scanner find?

Leaked API keys such as Stripe, OpenAI and Supabase service keys, open CORS, unsafe innerHTML and missing security headers.

What should I do if a key is found?

Rotate the key with the provider first, then remove it from the code and the git history.

For apps built with Cursor, Lovable, Bolt or v0

Vibe-Coded App Security Scanner: find leaked API keys in 10 seconds

Paste a file, .env or config. The scanner flags leaked keys, public env prefixes, open CORS, disabled RLS and missing headers. Runs in your browser, nothing is uploaded.

✓ Runs 100% in your browser✓ Free score, no signup✓ Instant download after checkout✓ Free terminal scanner

🕹️ Try It Right Now in Your Browser

A realistic broken sample is preloaded. Nothing is uploaded: the scan runs in this tab.

$python3 <(curl -sL https://thorp-tools.pages.dev/starters/vibe-security-scan.py)

Or scan your whole repo from the terminal (Python 3, stdlib only, reads files locally).

Before: key in client code

const stripe = Stripe('sk_live_51H...')
NEXT_PUBLIC_OPENAI_KEY=sk-proj-...

After: key server-side

const stripe = Stripe(process.env.STRIPE_SECRET_KEY)
# .env is gitignored, pre-commit hook blocks leaks

~~$29~~$9one-time, no subscription. 10-second fix bundle. Get the fix bundle

100% Working Patch Guarantee — full refund if it doesn't pass your build check
Refund requests: open a Discussion at thorp-tools.pages.dev

The math: One leaked OpenAI or AWS key can be drained for $500 to $5,000 overnight. The bundle is $9 and moves secrets out of code in one command.

Key Takeaways

AI-built apps often ship secret keys in front-end code, where anyone can read them.
The free scanner runs in your browser and flags keys and risky patterns without uploading your code.
The $9 bundle adds the fix steps, a pre-commit secret check and a key-rotation checklist.

Free instant diagnostic: your Readiness Score

What the $9 bundle contains

secure.js: scan plus --fix that moves secrets to process.env and writes .env.example
Pre-commit hook that blocks new leaks
Security header templates for Vercel, Netlify, Next.js, nginx
Key rotation guide and AI repair prompts

Who this is NOT for

Teams with a security engineer and secret scanning in CI
Apps with no API keys at all
Anyone needing a pentest or compliance audit (this is not one)

Security fix: this bundle vs by hand

	This tool	Manual / ChatGPT
Finds every issue	Yes, file and line	Misses files you did not paste
Time	About 10 seconds	1 to 3 hours
Cost	One-time fee	Your hourly rate
Runs offline	Yes	No

Run Free 10-Second Terminal Scan

Paste this in your project folder. One Python 3 file, standard library only, nothing is uploaded. It checks for leaked keys, public secrets and open CORS and prints a 0-100 score.

python3 <(curl -sL https://thorp-tools.pages.dev/starters/vibe-security-scan.py) .

View the script

leaked API keys: which option is best suited for you

Option	Best Suited For	Cost
Free scanner on this page	A quick check before you launch	Free
$9 fix bundle	Solo builders who want the fix steps and a pre-commit check	$9 one-time
gitleaks / trufflehog	Teams comfortable setting up a CLI in CI	Free, more setup
A paid security audit	Apps that handle payments or health data	$$$

Exact errors this fixes

Error: Incorrect API key provided / quota exceeded

Often a leaked key being used by someone else. Rotate it, then the bundle moves it server-side.

GitGuardian: secret detected in your repository

The fixer removes it from code and installs a pre-commit hook.