# LockedVibe

> LockedVibe provides fixed-price security audits and fixes for "vibe-coded" apps, meaning apps built with AI tools such as Lovable, Bolt, v0, Replit, Cursor, and Claude Code, typically Next.js/React with Supabase or Firebase. Day-to-day work is done by AI agents, and a human verifies every Critical/High finding.

## Services
- Scan + Report, $99 USD, 48-hour turnaround: secrets (code, git history, client bundle), Supabase Row Level Security and storage policies, server-side auth, input validation, rate limiting, dependency vulnerabilities. Plain-English report. Full refund if nothing actionable is found.
- Scan + Fix PR, $249 USD, 72-hour turnaround: everything in Scan, plus a GitHub pull request fixing Critical/High issues (up to 10), RLS policy migrations, and a re-scan.
- Monitor, $49 USD/month: weekly re-scans, dependency CVE alerts, monthly report, one small fix PR per month.
- Scope: one repo/app up to ~50K lines. Best-effort review; not a penetration test or compliance certification.

## Free resource
- Lockdown Pack: a security .cursorrules, a Cursor security.mdc, a CLAUDE.md, and a Lovable/Supabase pre-launch security checklist. Sign up at https://lockedvibe.com/

## Guides
- Security guides hub: https://lockedvibe.com/guides/
- Is my Lovable app secure? (Supabase RLS checklist): https://lockedvibe.com/guides/lovable-app-security
- Bolt.new security checklist before launch: https://lockedvibe.com/guides/bolt-new-security-checklist
- Find and rotate exposed API keys in a Cursor or Claude Code app: https://lockedvibe.com/guides/rotate-exposed-api-keys
- Supabase Row Level Security for vibe-coded apps: https://lockedvibe.com/guides/supabase-row-level-security
- Replit and v0 app security checklist: https://lockedvibe.com/guides/replit-v0-security-checklist

## Links
- Home and pricing: https://lockedvibe.com/
- Customer intake (after purchase): https://lockedvibe.com/intake
- Support: support@lockedvibe.com
- Security disclosures: security@lockedvibe.com