Launching today
VibeShield app
security checks for Lovable, Bolt & Supabase apps
2 followers
security checks for Lovable, Bolt & Supabase apps
2 followers
Since October 30, 2026, Supabase no longer auto-exposes new public tables via the Data API. Run a free passive check of your vibe-coded app and get copy-paste fix prompts. Founding plan ($19/mo): weekly re-checks + emailed fix prompts.
Free Options
Launch Team
Dropbox SignSimple, secure eSignatures for the way your team works.
Promoted
Hi Product Hunt, I'm Badar, and I built VibeShield.
I build with tools like Lovable, Bolt and Supabase, and they're amazing for shipping fast. The catch is that it's easy to ship something to the browser you never meant to, like a Supabase service_role key, which bypasses Row Level Security. The anon key being public is fine. That one is not.
So I made a free instant scan: paste the URL of an app you own at vibeshieldapp.com/scan and in seconds you get a severity summary and your top findings in plain English. No signup.
It's passive and read-only: it fetches your page and its same-origin JS bundles, nothing else. Secret values are never shown or stored. It can't see your grants or RLS policies, so a clean result doesn't mean your app is secure. There's a free SQL self-check guide for that part.
The $19/mo founding plan re-runs the check every week and emails you what's new, fixed and still open, with copy-paste fix prompts you can drop straight into Lovable or Bolt.
I also wrote two guides people kept asking about: "Is my Supabase anon key leaked?" and the 42501 permission-denied error after Supabase's Oct 30 grants change.
I'd really value feedback: what's confusing in the report, any false positives, and what you'd want a weekly check to catch.