Routelint finds APIs that leak data across users. It records the calls your vibe-coded app already makes, then replays them with no session and as a peer account to catch unguarded routes, cross-user (IDOR) access, exposed secrets and PII, and forgotten paths like /.env. A free public check also scores how your site reads to search engines and AI answer engines (SEO and GEO). Free accounts include five test suites and three sites.