Launched this week
VibeAlarm
See if your AI-built app is leaking API keys.
2 followers
See if your AI-built app is leaking API keys.
2 followers
Apps from Lovable, Bolt, Cursor, Replit, and v0 can expose API keys or database configs to anyone, or quietly break. Paste a URL. The free check tells you what a stranger can already see. No sign-up. It does not submit forms or log in. Not a security audit.
Free Options
Launch Team
Render Sandboxes: a computer for every agentGive every agent its own machine. Starts in under a second
Promoted
Hi, we are the Izzet Labs team behind VibeAlarm.
Apps shipped from Lovable, Bolt, Cursor, Replit, and v0 can leave an API key or database config on a public page, or quietly break after the next edit. We built VibeAlarm to show you what a stranger can already see.
Paste a URL. The check needs no account. It reads the public site only: homepage response, TLS, security headers, known secret shapes in public JavaScript, one read if a Supabase or Firebase config is public, plus robots.txt and sitemap.xml. It does not submit forms or sign in.
Paid plans recheck once a day. After domain verification, you can record sign-up, login, and checkout flows. Monitor is $19/month for one app. Watch is $49/month for five apps, plus a weekly pass for leaked keys.
This is not a security audit. We would love feedback on whether the results are clear, what they miss, and whether the plan split is useful.