Apps built with Lovable, Bolt, v0, Cursor and Claude Code ship fast — and ship the same holes. vibeward catches the risky request before your AI acts on it — "disable RLS", "use the service_role key in the frontend" — and scans the finished code from a URL or your repo, with reports your AI can turn into a fix.
$ npx vibeward@latest https://your-app.lovable.app
Most holes start with a prompt. vibeward runs as a Claude Code hook and stops the dangerous ask the moment you type it — deterministic, so it can't be prompt-injected away.
"disable RLS so it works" "use the service_role key in the frontend" "make the users table public to debug" "remove the login for now"
Blocks the request with why it's dangerous and the safe alternative — before the model touches your code.
{ "hooks": { "UserPromptSubmit": [
{ "hooks": [{ "type": "command", "command": "npx vibeward@latest guard" }] }
] } }
The exact holes AI coding tools leave behind — across the front end, the back end, and the database.
Supabase service_role, Stripe, OpenAI, AWS, GitHub and more — in bundles or source, with the exact file:line.
Tables readable without auth, permissive USING (true) policies, and risky SECURITY DEFINER functions.
SQL injection, open CORS, command injection, eval, and verbose error leaks in your API routes.
Committed SQLite/.db files and .env secrets shipped in the repo or the build.
Missing CSP, HSTS, X-Frame-Options — and tech-stack leaks that hand attackers a target list.
Every finding ships with CWE, exploit path, impact and references — the context an AI needs to open a correct PR.
A fast look from the outside, or a deep audit from the code.
Point it at a live app. Scans bundles for secrets, probes Supabase RLS, checks headers.
npx vibeward@latest https://app.lovable.app
Point it at a repo or a downloaded ZIP. Scans source, backend and SQL migrations.
npx vibeward@latest scan ./your-app
Add it once and it scans every push, failing the build on a critical and posting findings to the Security tab.
- uses: JSiapoDEV/vibeward@v1
This is what a single finding looks like — enough for a human to grasp the risk and for an AI to fix it.
users readable without authenticationGET /rest/v1/users?select=* with the anon key from the JS bundle — every row comes back, no login.No install. Always the latest. Read-only.
$ npx vibeward@latest scan ./your-app