VibeScan — Security Scanner for Vibe-Coded Apps

Authentication & Access Control

0/5

All API routes that return or modify user data check authentication before proceeding

Sessions are invalidated server-side when a user logs out

Password reset uses a random, single-use, time-limited token — not just the user's email

Admin routes are protected and not accessible to regular users

0/5

Row Level Security (RLS) is enabled on all Supabase tables containing user data

Database connection string is never exposed in client-side code or NEXT_PUBLIC_ variables

All user-facing database queries filter by the authenticated user's ID

No raw SQL queries built by concatenating user input with strings

Database backups are enabled and tested

0/5

No API keys or secrets are hardcoded in source files

No sensitive values use NEXT_PUBLIC_ prefix (or equivalent client-side exposure)

.env files are in .gitignore and never committed to version control

All third-party API calls (OpenAI, Stripe, SendGrid) are made from server-side code only

Git history has been checked for any previously committed secrets

0/6

App is served over HTTPS with valid SSL certificate

X-Frame-Options: DENY is set (prevents clickjacking)

X-Content-Type-Options: nosniff is set

Strict-Transport-Security header is set with max-age ≥ 31536000

Content-Security-Policy header is configured

CORS is restricted to your specific domain (not wildcard *)

0/5

User passwords are hashed (never stored in plaintext)

Sensitive user data (payment info, health data) is encrypted at rest

Users can delete their account and associated data

Error messages shown to users are generic — no stack traces or internal paths

VibeScan checks HTTPS, security headers, CORS, and exposed secrets automatically — no manual work required.