PLAYER 1: READY TO LAUNCH?
Every vibe-coded app has a health bar. Paste your GitHub link and VibeHP shows what's draining it: leaked keys, open Supabase tables, broken builds and vulnerable packages. You also get a healing plan with a copy-paste AI prompt for every fix.
One-time payment · No account · Report in minutes · Works with Lovable, Bolt, Cursor, Replit, v0
using (true))+5 HP.env committed to git+5 HPAny public GitHub repo, built with AI or by hand.
Your code and its git history, plus a real clean install and production build.
A 0–100 health bar, broken down by category so you see where the damage is.
Each fix shows its +HP and a prompt for Cursor or Lovable. Fix, push, then use your free re-scan.
Tables without Row Level Security, using (true) policies that let anyone read everything, the service_role key leaking into the browser, and wide-open Firebase rules. We know the anon key is meant to be public, so we only flag it when it's actually dangerous.
OpenAI, Stripe, Anthropic, Google keys and more, in code or old commits. Test fixtures are skipped.
A clean npm install && npm run build, exactly like Vercel or Netlify.
Dependencies with known security holes, grouped by severity.
Industry-standard static analysis for common security bugs.
Committed .env, a missing .env.example, a leaky .gitignore.
Data calls without error handling, and no error boundary (the white screen of death).
Excerpt from scanning a public school-management app built with Lovable + Supabase.
Don't launch yet. Real users or data are at risk.
🔴 Critical: 2 🟠 High: 3 🟡 Medium: 2 ⚪ Low/info: 3 · Heal all critical + high → HP 93/100
Why it matters: These tables are created without RLS. With the public anon key, anyone may read or write them.
Where: health_records, payments, mpesa_c2b_transactions, attendance_records, …
📋 Copy-paste this into Cursor / Lovable:
Enable Row Level Security on these Supabase tables: attendance_records, credit_notes, health_records, payments, … Write a migration that runs `alter table ... enable row level security` and adds sensible policies (users can only read/write their own rows via auth.uid()). Explain each policy.
General scanners are great for broad code health. VibeHP goes deep on what breaks Lovable, Bolt and Supabase apps on day one.
| VibeHP | ShipScanner | |
|---|---|---|
| Score | HP 0–100 with +HP per fix | 300–850 + letter grades |
| Supabase RLS / service_role / Firebase rules | ✅ Deep, migration-aware | Not a listed focus |
| Real production build test | ✅ | Not listed |
| Copy-paste AI fix prompts | ✅ | ✅ |
| Pricing | $19 one-time | Free tier · $12/mo · $39/mo |
No subscription. No account needed.
It's your app's launch health out of 100. Big problems like leaked keys or open databases take big chunks. Repeated small issues in the same category take less each time, so one messy area can't drop you to zero on its own.
Free scanners give you a broad code score. VibeHP goes deep on what actually breaks vibe-coded apps: Supabase/Firebase security, real production builds, and leaked keys in history. You also get a healing plan you can paste straight into your AI editor.
No. It's an automated pre-launch check for the most common and most expensive mistakes. If you handle payments or sensitive data at scale, get a human audit too.
No. Every finding explains why it matters in plain English and comes with a prompt for Cursor, Lovable, Bolt or ChatGPT.
Public only for now. Private support via a read-only GitHub app is coming.
Usually a few minutes, always within the hour.
If the scan fails on our end, you're refunded automatically.
We clone your repo into a temporary, isolated sandbox, scan it, and delete it as soon as the scan finishes. We never store your code, never train AI on it, and never use or test any secret we find. Secret values never appear in your report, only where they are. Your report goes only to the email you give at checkout.