Is my vibe-coded app secure?
How to tell whether an app built with Lovable, Bolt, Cursor or Replit is secure: the eight places AI-built apps usually break, and how to check each one.
Guides
Questions on the way to production.
Short, specific answers to what founders ask before and after launch, each with steps you can follow without us. Where vibeship checks something automatically, the page says so, and says what it doesn't check.
Updated 25 October 2026
All guides
What should I check for security before launching my app?
The security checks to run before you launch or start charging: keys, database rules, access between users, private files, sign-in limits and headers.
How do I check that Supabase Row Level Security protects my data?
How to check that Supabase Row Level Security is on and actually protects your tables: the dashboard, one SQL query, a test as a stranger, and common traps.
Is my Firebase or Supabase key exposed, and does it matter?
Which API keys are safe in your website (Firebase, Supabase anon, Stripe pk_) and which are a breach (service keys, sk_live, OpenAI), and what to do.
How do I add security headers to a Next.js app?
Add the six security headers to a Next.js app in next.config.js: CSP, HSTS, nosniff, frame protection, referrer and permissions policy, with a copyable config.
How can I check my website for vulnerabilities for free?
Free ways to check a website for vulnerabilities: what MDN Observatory, SSL Labs, OWASP ZAP, npm audit, gitleaks and the vibeship quick check each cover.
Am I affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619)?
Check whether your site is affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619): which PHP versions are vulnerable, the fixed releases, and what to do now.
What are the GDPR basics for a small SaaS?
The GDPR basics a small SaaS needs: privacy policy, legal basis, processor agreements, cookie consent, data requests, breach reporting and EU transfers.
What belongs on a production readiness checklist for a small SaaS?
A production readiness checklist for a product with its first paying users: security, data and backups, monitoring, speed, email, legal pages and support.
How do I stop my emails going to spam and others faking my domain?
Set up SPF, DKIM and DMARC so your app's emails reach the inbox and nobody can send invoices as your domain: example records and how to check them.
Is my .env file or .git folder publicly accessible?
How to check whether your .env file, .git folder, backups or admin pages can be downloaded from your website, and what to do if one of them opens.
Comparing tools?
Fair comparisons with the tools people name next to vibeship, including where the other tool is better.
Best effort, not a guarantee: Our scans are best effort: they can miss a weakness or flag one that isn't there. This is advice, not a guarantee, and it doesn't replace a security firm. Your site's safety stays your responsibility. Read the terms.