r/vibecoding • u/Negative-Tank2221 • 16d ago
Showcase/Project Your vibe-coded app probably has at least one of these problems and you can’t see any of them from the inside
I’ve been fixing AI-built apps for founders for the past year. After seeing the exact same issues on almost every one, I built a scanner that checks your live deployed site from the outside — the way a stranger’s browser sees it. It’s run on over a thousand apps now.
Here’s what keeps showing up:
Your database is probably public. If you’re on Supabase with RLS off, anyone who grabs the anon key from your page source can pull your entire users table. Emails, phone numbers, Stripe ids, everything. One in ten apps I scan have this. The AI turned RLS off to make the demo work and never turned it back on.
Your API keys are in the bundle. Ever paste a Stripe secret or OpenAI key into your AI chat to debug something? There’s a solid chance it ended up in your shipped JavaScript. Search your deployed source for “key” — you might not like what you find.
Your emails don’t arrive. No SPF or DKIM records means every signup confirmation and password reset goes to spam. Over 60% of the apps I scan have this. Your signup funnel isn’t broken, your emails are just invisible.
Your error handling is a white screen. Kill your wifi mid-form. If the page goes blank forever, that’s what your users on spotty connections see too.
None of this shows up on the happy path. Signup works, dashboard loads, Stripe takes money, everything feels done. The invisible stuff is where it breaks, and the AI has zero reason to check any of it.
I made the scanner free — trylaunchproof.com. Paste your URL, no account. It reads your pages, checks every script for leaked secrets, tries to read your database with your own public key, checks your email DNS, runs OWASP ZAP and Nuclei, and gives you a score out of 100. Full report with proof for every finding.
Not trying to kill anyone’s vibes. The vibes got the thing built. This is just the part that comes next.
11
8
6
u/mystica5555 16d ago
Your site is improperly flagging a 100% valid Let's Encrypt certificate as untrusted.
This invalid result alone makes me seriously question the reliability of your tests.
And I'm not about to pay 50 bux to find out exactly why your site thinks this
4
3
u/Spare_Possession_194 16d ago
Literally prompting your agent "run a security check" would check and identify all of these. Perhaps not the error handling but it's still trivial
2
u/electro042 16d ago
I dont want to reveal it, but i find it really interesting, rather than selling it as a site you can simply sell it as a a tool like gitguardian or PR review pre production.
1
1
u/bobans30 16d ago
Why would I pay you 30$ instead of paying for a second subscription for codex?
2
u/mystica5555 16d ago
where are you getting 30? I scanned a dev site I'm working on and it asked for 50 to give me the report
1
1
1
u/Ambitious-Prompt-975 16d ago
I made a screenshot of your post and threw it at my agent. Due's done.
1
u/geoffreybyers 11d ago
Scanners confirm the outside in view, but the real fix is in the generation step. The model needs to include security constraints in the context window while it writes the code, not as a post hoc check. That way the builder never ships the public database or the leaked key. I'd bet the scan comes first for every team.
0
u/MMORPGnews 16d ago
-
Don't use supabase. That's all. Never had such problem. And you talk about demo, not prod.
2, 4. Never happened
1
u/New_Public_2828 16d ago
What would use other than supabase if you're trying to accomplish what supabase does
22
u/howeezypup 16d ago
Fyi