LockedVibe
Start intake Get the scan

scan + report · $99

Check your AI-built app for the leaks that keep making the news.

Most AI-app data leaks come down to a few mistakes: a secret key shipped to the browser, a database table anyone can read, an admin route with no login check. The $99 Scan + Report looks for all of them in one repo and its live app, and tells you exactly how to fix what it finds.

What the $99 covers

  • Leaked secrets in your code, your git history and the JavaScript your site actually ships
  • Supabase Row Level Security and storage rules: can a signed-out visitor, or another user, read rows they shouldn't?
  • API routes and admin pages with missing auth checks, input validation or rate limits
  • Known vulnerabilities in your dependencies
  • A private report that ranks every finding by severity, shows the evidence and gives you a copy-paste fix

Built for JS/TS apps (Next.js, React/Vite, Node) on Supabase or Firebase, which is what Lovable, Bolt, v0, Replit, Cursor, Claude Code and Codex usually produce. Up to about 50K lines of code.

one repo, one app

$99one time
  • Report usually within 48 hours
  • Read-only access, or just upload a zip
  • Full refund if we find nothing actionable
Get the scan ($99)

Secure checkout on Stripe. Then fill in the 2-minute intake form.

Not ready to pay? Run the free Leak Checker on your live URL first. It takes about 30 seconds and there's no signup.

How it works

  1. Pay on Stripe. $99, one time. No subscription.
  2. Fill in the intake form. Your repo link or a zip, your live URL, and written permission to test the app. It takes about 2 minutes at lockedvibe.com/intake.
  3. We run the scan. gitleaks, semgrep, npm audit and Supabase RLS checks, then automated evidence checks mark each finding confirmed or probable.
  4. You get the report. A private link by email, usually within 48 hours. Then we remove our access and delete our copy of your code.

Good to know before you buy

What we need: read-only access (a deploy key we send you, or a read-only invite for an organization repo) or a zip of your code, plus your live URL. For the database checks, your Supabase URL and public anon key. Never your service-role key.

What it isn't: this is an automated, AI-assisted review with evidence checks on every finding. Nobody hand-checks each finding, and it isn't a penetration test or a compliance certificate. Details are in our Terms.

Want to see the output first? Here's a sample report from a deliberately broken demo app. Only need a quick look at your live site? The $29 Quick Review checks the URL alone. Questions? support@lockedvibe.com