Free · Open source (MIT) · v0.1.0 · Runs locally
Is your AI-built app leaking? Check your repo in 10 seconds.
vibefix-check reads your project folder on your own computer and flags the mistakes AI coding tools make most: secret keys in front-end code, Supabase tables without Row Level Security, policies that let everyone in, and Stripe webhooks anyone can fake. Every finding links to a plain-English fix.
Run it
Option 1: one file, nothing to install. Needs Python 3.9 or newer (already on most Macs and Linux machines; on Windows, download the file and run py vibefix-check.pyz .).
curl -fsSLO https://vibefixkit.com/check/vibefix-check.pyz python3 vibefix-check.pyz .
Option 2: install the command with pipx (or pip install):
pipx install https://vibefixkit.com/check/vibefix_check-0.1.0-py3-none-any.whl vibefix-check .
Options: --format text|json|markdown · --fail-on critical|high|medium|low|never (exit code for CI) · --include-tests · --list-rules. Silence a line with a vibefix-ignore comment, or list paths in a .vibefixignore file.
What you'll see
$ vibefix-check .
vibefix-check 0.1.0: scanned 214 files
CRITICAL VF001 Supabase service_role key in code
src/lib/supabaseAdmin.ts:1 service_role JWT eyJhbGci…(187 chars)
Why: The service_role key bypasses every RLS policy. Anyone who finds it can read and change all your data.
Fix: https://vibefixkit.com/fix/secret-key-exposed-in-frontend/
CRITICAL VF006 Supabase table created without Row Level Security
supabase/migrations/001.sql:1 table public.todos never gets `enable row level security`
Why: Without RLS, a table that is reachable through the Data API can be read or written with the public anon key.
Fix: https://vibefixkit.com/fix/supabase-rls-new-row-violates/
HIGH VF011 Stripe webhook handler without signature verification
app/api/webhook/route.ts:2 handles Stripe events but never calls constructEvent
Why: Without stripe.webhooks.constructEvent (or equivalent), anyone can POST a fake 'payment succeeded' event.
Fix: https://vibefixkit.com/fix/stripe-webhook-signature/
Score 38/100 · 2 critical · 1 high · 0 medium · 0 low
Runs locally. Nothing was uploaded. Fix pages: https://vibefixkit.comSecrets are always blanked out in the output: only the first 8 characters and the length are shown.
The 14 checks
Each one links to the fix page with a prompt you can paste into Cursor, Claude Code, Lovable or Bolt.
| Rule | Severity | What it finds | Fix |
|---|---|---|---|
| VF001 | Critical | Supabase service_role / secret key in code | Fix |
| VF002 | High | A secret in a NEXT_PUBLIC_ / VITE_ / EXPO_PUBLIC_ variable | Fix |
| VF003 | Critical | Stripe secret or restricted key in code | Fix |
| VF004 | High | OpenAI, Anthropic, xAI, GitHub, AWS, Slack and similar tokens in code | Fix |
| VF005 | High | .env file that git isn't ignoring | Fix |
| VF006 | Critical | Supabase table created without Row Level Security | Fix |
| VF007 | High | RLS policy that lets everyone in: using (true) / with check (true) | Fix |
| VF008 | Critical | Row Level Security switched off (the classic AI “fix”) | Fix |
| VF009 | Medium | View without security_invoker (bypasses RLS) | Fix |
| VF010 | Medium | SECURITY DEFINER function without a fixed search_path | Fix |
| VF011 | High | Stripe webhook that never verifies the signature | Fix |
| VF012 | Critical | Private key (PEM) committed to the repo | Fix |
| VF013 | Critical | Firebase rules open to everyone (if true) | Fix |
| VF014 | Low | Client code calling localhost | Fix |
- Supabase anon/publishable keys are public by design and aren't flagged. A key is only flagged when its decoded payload says service_role.
- All your SQL migrations are read together, so a table that gets RLS in a later migration isn't flagged.
- Test and fixture folders are skipped unless you pass --include-tests.
Privacy: it runs on your machine and sends nothing
vibefix-check makes no network requests: no telemetry, no update checks, no account. It only reads files in the folder you point it at and prints the result. The code is short and readable, so download the source below and check for yourself.
Only scan code you own or are allowed to review. It reads your code, not your live app.
Run it on every pull request
GitHub Actions example. On other CI services, use the same install and run lines.
# .github/workflows/vibefix.yml
name: vibefix-check
on: [pull_request, push]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with: { python-version: "3.12" }
# pip refuses the file if its SHA-256 doesn't match
- run: pip install "https://vibefixkit.com/check/vibefix_check-0.1.0-py3-none-any.whl#sha256=ff486b6d1bd02555e6ea284fa087155d98f8509920614654fbdf0b6a22e05557"
- run: vibefix-check . --format markdown --fail-on never >> "$GITHUB_STEP_SUMMARY"
- run: vibefix-check . --no-color --fail-on highDownloads and checksums
Version 0.1.0. Verify any file against SHA256SUMS.txt.
| File | Size | SHA-256 |
|---|---|---|
| vibefix-check-0.1.0-src.zip Source code + tests, as a zip | 18.3 KB | b080246407f4e9c066a5bd82bcff01f42d7f8066e01020f378acf42dd27f9bf1 |
| vibefix-check-0.1.0.pyz Single file: download and run with Python 3.9+ | 8.1 KB | 13284c23f019b52c0abd40fa81e3258beab4cc1ce84d4df456a14cc69890dca3 |
| vibefix-check.pyz Same file, always the latest version (0.1.0) | 8.1 KB | 13284c23f019b52c0abd40fa81e3258beab4cc1ce84d4df456a14cc69890dca3 |
| vibefix_check-0.1.0-py3-none-any.whl Wheel for pip / pipx | 13.4 KB | ff486b6d1bd02555e6ea284fa087155d98f8509920614654fbdf0b6a22e05557 |
| vibefix_check-0.1.0.tar.gz Source package (pip can install this too) | 17.6 KB | 09f731f095659d693ea68cd0628302f4e9430ea20e374a36072cb2b9fab6729c |
curl -fsSLO https://vibefixkit.com/check/SHA256SUMS.txt sha256sum -c SHA256SUMS.txt --ignore-missing # macOS: shasum -a 256 -c SHA256SUMS.txt --ignore-missing
What it can't do
It's a pattern scanner for common AI-generated mistakes, not a penetration test. It can't see policies you only created in the Supabase dashboard (export them with supabase db dump --schema public and scan the dump), it doesn't test your live API, and a clean score doesn't prove your app is secure. Found a false positive? Email [email protected] with a small snippet (never real keys).
Found something? Here's more help.
Fix it yourself with the free fix pages, or get the full system.
Free
Repo checker
vibefix-check finds leaked keys, tables without RLS and unsigned Stripe webhooks in your own code.
- 14 checks, runs locally
- Every finding links to a fix
- Works in CI (fails a PR on high risk)
$19
Fix & Launch Kit
The system behind the fix pages: a debug method, prompts, Supabase templates and checklists.
- 60-page PDF + Markdown
- 24 prompts, 12 playbooks
- 55-point pre-launch checklist
$49
Lockdown Pack
Guardrails in your repo so your AI tool never “fixes” an error by turning security off.
- AGENTS.md + Cursor rules
- 5 agent skills (review, RLS writer, secrets sweep…)
- RLS audit + two-user test SQL, CI gate
$149
Launch Review
A security review of your app, approved by a human before you get it.
- Report in 48 hours, ranked by severity
- Paste-ready fixes + one re-check
- Read-only · max 10 per week
Checkout by Gumroad. 14-day refunds on all paid tiers (Launch Review: before delivery, or if the report has nothing actionable). General technical guidance, not a guarantee your app is secure.