Security scanning for AI-built apps
VibeShield
Your AI shipped it.We check what it left open.
Connect your GitHub repo and VibeShield scans it for leaked keys, open database rules and vulnerable packages — on a schedule, and again on every change you push.
SecretsDatabase rulesDependencies
What goes wrong
Where your AI app is exposed
Database rules off, keys in the browser, endpoints nobody checks. Almost every fast-built app has one.
What we do
We scan your app and explain it
Not a list of CVE numbers — one sentence per finding: what could happen, and what closes it.
What you keep
Fixes for your app, not tickets
We open the pull request. You click approve. Every push after that is checked again.
The gap
The last 20% isn’t polish.
It’s the part where the thing has to be safe, work for somebody who isn’t you, and stay reachable at a URL.
- 01
The secrets went into the bundle
Vite inlines anything prefixed for the client. The service key ships to every visitor.
- 02
Auth that only looks like auth
The admin button is hidden in the UI. The endpoint behind it still answers anyone.
- 03
A database with no rules on it
Row-level security was never switched on, so every row is readable by anyone.
- 04
Nothing catches the errors
A failed request leaves a white screen. You hear about it from a screenshot.
- 05
It only builds on your machine
A drifted lockfile, an undeclared peer dependency, an env var living in your shell history.
- 06
There is no undo
No staging, no rollback, no backup. The only copy of the data is in production.
Securing your AI app
The risks of an AI-built app
AI tools write code that works, but security is rarely part of the brief. These are the four risks we see most often, and what they mean for your users' data.
Leaked keys
API keys and your database's service key end up in browser code, a bundled .env file or your git history. Whoever finds such a key uses your account and your data.
Open database rules
Tables without row level security, or with rules that let everyone through. With the public key from your website, the whole database can then be read.
Vulnerable packages
AI tools pick packages for what works, not for what is safe. One outdated dependency with a known vulnerability is enough for an attack that was documented long ago.
Prompt injection
If your app uses an AI model itself, someone can give it different instructions through clever input: request data, ignore rules or perform actions. Give the model no more rights than it needs and treat its answers as untrusted input.
What happens to sensitive data?
If your app stores names, email addresses or payment details, the GDPR makes you responsible for securing them, even if an AI tool wrote the code. If something leaks, you usually have to report it to the data protection authority within 72 hours.
If your app sends data to an AI model, such as one from OpenAI or Anthropic, that provider processes it on your behalf. Put that in a data processing agreement, send only what is needed and never put passwords or keys in a prompt.
The EU AI Act is about AI you offer yourself, not the tool you build with. If your users talk to a chatbot in your app, you must make clear since 2 August 2026 that they are dealing with AI.
VibeShield checks the first three risks automatically, on every push: keys, database rules and packages.
The scan
What we actually look at.
Connect the repo and VibeShield works through it the way somebody trying to break in would — then hands you the fix, not a report to interpret at midnight.
01
Secrets
The single most common way a vibe-coded app leaks.
- Keys traced through code, build output and logs
- Client bundles checked for inlined server keys
- Git history scanned for keys you already rotated past
02
Database rules
Row-level security, read against your actual schema.
- Tables exposed through the API with no policy
- Policies that are broader than they look
03
Dependencies
Known vulnerabilities in the packages you pulled in.
- Advisories matched to your lockfile
- Ranked by whether the path is reachable
04
Auth and endpoints
Hidden in the UI is not the same as protected.
- Routes and functions probed without a session
- Admin paths that answer anyone who asks
- Input that reaches a query unescaped
05
Config
The settings nobody remembers to check.
- CORS, headers and cookie flags
- Debug modes and stack traces left on
06
Every change
The scan re-runs when you push, on every plan.
- A verdict on the commit, not a monthly surprise
- Each finding ships with a patch
07
Backups
Automatic copies of your data, without you having to think about it.
- Your database is backed up automatically
- If something goes wrong, you restore an earlier version
08
Uptime monitoring
We keep an eye on whether your app is reachable — and you're the first to know when it isn't.
- Continuous checks that your site and app are up
- An alert the moment something goes down
How it works
From repo to verdict in a minute.
- 01
Connect the repo
GitHub in one click, or run the CLI. No config file, no rewrite.
- 02
Read the findings
Ranked by severity, each with a patch you can read.
- 03
Fix it in your AI tool
Connect your AI tool through the VibeShield MCP and apply each fix straight from the editor you already build in.
- 04
Stay scanned
Daily, weekly or monthly — plus every change you push.
~/your-projectzsh
$ npx vibeshield scan4 security findings in this repoapps/web/.env.productionservice key is inlined into the client bundle→ patch available$ npx vibeshield fix4 patches applied$ npx vibeshield watch --dailyscanning on schedule + on every push
Included
And then we host it in the Netherlands.
Not as an upsell. If we are the ones telling you it is not safe where it runs now, we should be able to show you somewhere it is.
NL
Datacenter in Amsterdam or Groningen
EU
Backups and logs stay inside the EU
Try VibeShield
Try an app security scan once for free.
Check your AI-built app for leaked keys, open database rules and vulnerable packages. Get findings you can act on, with fixes for your AI tool.
Try once for free
Start in the VibeShield app.
Pricing
Pick how often we look.
Every plan runs the same scan — secrets, database rules, dependencies, exposed endpoints. The difference is how often we look, and from Standard up we also watch whether your app is online. Every push to main is re-scanned in every plan.
Monthly scan
VibeShield Secure Starter
For a side project that is live but rarely changes.
€9,99/ month
Excl. VAT
- Full security scan once a month
- Scan on every push to main
- Start a scan yourself whenever you like
- React apps from GitHub and WordPress sites
- Email alert on critical findings
- Findings with a patch attached
Most picked
Weekly scan
VibeShield Secure Standard
For a product with real users and a normal release rhythm.
€19,99/ month
Excl. VAT
- Everything in Secure Starter, plus:
- Full security scan every week
- Uptime monitoring: a check every 15 minutes
Four scans a day
VibeShield Secure Pro
For anything you would not want to explain to a customer.
€39,99/ month
Excl. VAT
- Everything in Secure Standard, plus:
- Full security scan four times a day
- Uptime monitoring: a check every minute
Not sure which scan fits you yet? Start with one free scan and see the findings yourself.
Start with a free scanCompare the plans
What each plan includes, side by side.
| FeaturePrice | Starter€9,99 | Standard€19,99 | Pro€39,99 |
|---|---|---|---|
| Scan on every push to main (GitHub) | Included | Included | Included |
| Start a scan yourself | Included | Included | Included |
| React apps from GitHub | Included | Included | Included |
| WordPress sites | Included | Included | Included |
| Email alert on critical findings | Included | Included | Included |
| Scheduled full scan | Once a month | Once a week | Four times a day |
| Uptime monitoring (check interval) | Not included | Every 15 min | Every minute |
Connect the repo, cancel whenever. Need something bigger — more repos, SSO, an audit trail?
Talk to usFrequently asked questions about securing AI apps
What are AI apps?
Apps built with AI tools such as Lovable, Cursor, Bolt or Replit, or apps that use an AI model themselves, such as a chatbot. VibeShield focuses on the first group: apps whose code was written by an AI.
How do you use AI safely?
Do not paste passwords, keys or customer data into an AI tool, check what the AI builds before you put it live, and give an AI model in your app no more access than it needs. Have code written by AI scanned on every change for leaked keys, open database rules and vulnerable packages.
How do you secure an AI-built app?
Enable row level security on every table, move keys out of your frontend and rotate anything that ever leaked, update your packages and make every server function check its caller. Repeat that on every change; a scanner like VibeShield does it automatically.
Is an app built with AI secure?
Not by itself. AI tools deliver code that works, but security is usually not part of the brief. The mistakes we find most often are open database rules and keys in browser code.
What is prompt injection?
An attack in which someone uses input to give an AI model different instructions than you intended, for example to reveal data. It applies when your app uses an AI model itself. You limit it by giving the model few rights and checking its answers.
Does the GDPR apply to my AI app?
Yes, as soon as your app processes personal data such as names or email addresses. You then have to secure that data appropriately and usually report a data breach to the data protection authority within 72 hours.
What does the EU AI Act mean for my app?
If you only build with AI, little changes: the law is about AI you offer yourself. If your app uses AI to talk to people, such as a chatbot, you have to make clear that it is AI. Stricter rules apply to high-risk uses such as recruitment or credit scoring.
Can I have my AI app checked for free?
Yes. You can try a VibeShield security scan once for free in the VibeShield app. You connect your GitHub repo and see where your app has leaked keys, open database rules or vulnerable packages.