Free · read-only · no signup to see results

Vibe coding security scanner

You prompted an app into existence with Lovable, Bolt, v0, Replit, Cursor or Claude Code and it works. Kavach checks whether it is also secure: the live site the way an attacker sees it, and the code the way a reviewer would read it. Every finding comes with the attack it enables and the fix to paste back into your AI tool.

Scan my app free → Upload the code

What it checks

• Live site (seconds)Security headers, HSTS and TLS, cookie flags, CORS, exposed .env and .git for verified owners, third-party scripts and SRI, email identity (SPF, DKIM, DMARC), security.txt, HTTP to HTTPS.
• Code (minutes)String-built SQL, shell commands with user input, unescaped output, credentials in source, JWT secrets, disabled TLS verification, unsafe deserialisation, debug left on, Supabase RLS and Firebase rules, Dockerfiles and Terraform.
• Fixes, not just flagsA copy-paste Fix Pack for your stack, a remediation prompt for your AI tool, and an on-demand second opinion per finding.
• Keeps watchingVerify the domain, schedule re-scans, and get alerted when a new prompt or deploy opens something up.

How it differs from other vibe coding scanners

Most scanners in this space look only at the public URL, show one finding and ask for an account to see the rest. Kavach shows every live-site finding without an account, scans the code as well, and never keeps the archive. See the comparison with CheckVibe and with Vibe App Scanner.

By platform

Lovable · Bolt · v0 · Replit Agent · Cursor · Claude Code · Supabase · Firebase

Questions

What is a vibe coding security scanner?

A tool that checks an app built by prompting an AI (Lovable, Bolt, v0, Replit, Cursor, Claude Code) for the security mistakes those tools make by default: open CORS, missing headers, unflagged cookies, secrets in the bundle, permissive Supabase or Firebase rules, and injection patterns in the code.

Is Kavach's vibe coding scanner free?

Yes. The live-site audit shows every finding without an account. Code Scan and Ask Kavach AI have free monthly allowances; paid plans add more scans, monitoring and team features.

Does it scan the live site or the code?

Both. The live-site audit sees what an attacker sees. Code Scan reads the exported project for what the AI wrote. Most competitors do only the first.

Is my code safe with Kavach?

The archive is analysed in memory, never extracted to disk, and deleted the moment the scan ends. Only findings are kept, with credential values masked. AI second opinions run on our server or at a provider that does not train on your data.

How long does it take?

The external audit takes seconds. Code Scan handles hundreds of thousands of lines in a few minutes.

Will the scan harm my app?

No. Every check is read-only and rate-limited. Nothing is submitted to forms, brute-forced, fuzzed or taken down.

Results are observations, not certifications; see the disclaimer.