Is your vibe-coded app leaking?
Free, instant security check for apps built with Lovable, Bolt, v0, Cursor or Replit. Paste your URL to find leaked API keys, Supabase service_role keys, exposed .env files, public source maps and missing security headers, with plain-English fixes and copy-paste prompts for your AI builder.
Sale The scan stays free. Want it fixed for you? Launch sale: 20% off on Fix Pack, Deep Audit and Monitor through Nov 30, 2026 →
What Unspill checks
Stripe sk_live/sk_test, OpenAI, Anthropic, Groq, OpenRouter, xAI, AWS, GitHub, Slack, SendGrid, Resend, Twilio keys and private keys in your HTML and JavaScript bundles.
We decode Supabase JWTs and flag any with role service_role (or sb_secret_ keys): full database access, bypassing RLS.
Detects your Supabase project / Firebase config and walks you through verifying Row Level Security or Security Rules. We never query your database.
Publicly downloadable /.env and /.git/config, with SPA fallback detection so you don't get false alarms.
Production .map files that let anyone rebuild your original source code.
Content-Security-Policy, HSTS, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy, cookie flags.
http:// scripts, frames and images on an HTTPS page; sites not served over HTTPS.
One preflight request to an API route to see if any website can read its responses.
Why this matters
AI app builders get you from idea to live app in an afternoon, but they don't always get security right. The most common mistakes are boringly simple: a secret key pasted into front-end code to make an API call work, or a Supabase table shipped without Row Level Security. Public reports:
- CVE-2025-48757: missing Row Level Security in Lovable-generated Supabase apps (researcher reported 170 affected projects) (mattpalmer.io)
- “170 Lovable apps got hacked because of one Supabase setting” (r/vibecoding)
- An 18,000-user data leak discussed on r/vibecoding (r/vibecoding)
How it works
- You paste your app's public URL and confirm you own it.
- Unspill downloads only what a visitor's browser would: your page, its JavaScript and any public source maps, plus /.env, /.git/config and one CORS preflight. About 20 requests, 30 seconds max.
- You get a graded report. Every finding has fix steps, a full guide and a prompt you can paste into Lovable, Bolt or Cursor.
Read the methodology and limits →
Checklists for your stack
A practical security checklist for apps built with Lovable: Supabase RLS policies, secret keys, edge functions, storage …
Bolt.new security checklistSecurity checklist for apps built with Bolt.new: Bolt Database vs Supabase, VITE_ environment variables, Netlify secrets…
v0 / Next.js on Vercel security checklistSecurity checklist for Next.js apps generated with v0 or Cursor and deployed on Vercel: NEXT_PUBLIC_ variables, server a…
Supabase RLS check for vibe codersSix copy-paste SQL queries to find Supabase tables without Row Level Security, policies that allow everyone, public stor…
Firebase security rules checklistChecklist for Firestore, Realtime Database and Cloud Storage rules in AI-built Firebase apps: test-mode rules, request.a…
Is my Stripe secret key exposed?How to check whether your Stripe secret key (sk_live_), restricted key (rk_) or webhook secret (whsec_) is exposed in yo…
Replit app security checklistSecurity checklist for apps built with Replit Agent: the Secrets tool vs configurations, production app secrets, Securit…
Cursor-built app security checklistSecurity checklist for apps built with Cursor: keep .env files out of the agent's context with .cursorignore, keep secre…
Exposed OpenAI API key: what to doYour OpenAI API key (sk-proj-...) is in your front-end code, a public repo or a screenshot. Rotate it, check usage, set …
Supabase anon key vs service role keyWhich Supabase key is safe in the browser? The anon / publishable (sb_publishable_) key is public and limited by RLS; th…
Is my Firebase API key a secret?Your Firebase web apiKey is public by design and safe in client code, as long as it's restricted to Firebase APIs and yo…
Supabase RLS disabled: data leak checkIf a Supabase table in an exposed schema has Row Level Security disabled, anyone with your public anon/publishable key c…
Unspill vs Lovable Security Scan vs Supabase Security AdvisorAn honest comparison of three free security checks for AI-built apps: Lovable's built-in Security Scan, Supabase's Secur…
Fix guides
A Supabase service_role (or sb_secret_) key in front-end code gives anyone full read/write access to your database, bypa…
Verify Supabase Row Level SecurityYour Supabase anon key is public by design, so Row Level Security is the only thing protecting your tables. Run these SQ…
Stripe secret key exposedA Stripe sk_live_ or sk_test_ key in your JavaScript lets anyone create charges, issue refunds and read your customers. …
AI API key exposedAn OpenAI, Anthropic, Groq, OpenRouter or xAI key in your front-end bundle lets anyone run up your bill. Revoke it and p…
AWS access key exposedAn AWS access key ID in your JavaScript usually ships with its secret. Deactivate it in IAM, check CloudTrail, and use p…
Private key or Firebase admin credentials exposedA private key or Google service-account JSON in browser code gives admin access to Firebase/Google Cloud. Delete the key…
Third-party token exposedService tokens in front-end code (GitHub, Slack, SendGrid, Resend, Twilio) can be used by anyone to act as your account.…
Possible hard-coded secretVariables named secret, token, password or apiKey with long random values in front-end code are often real credentials. …
Exposed .env fileIf https://yourapp.com/.env downloads your environment file, every secret in it is public. Remove it from the deployed o…
Get it fixed, or keep it safe
Sale Launch sale: 20% off planned prices through Nov 30, 2026. Payments aren't open yet; the sale price applies to anyone who joins the waitlist before Nov 30, 2026.
We fix what the scan found for one app: keys moved server-side, headers, source maps, RLS for up to 10 tables, then a re-scan.
Deep Audit:Code, database rules, storage and auth tests (can user A see user B's data?), a written report and a 30-day re-check.
Monitor: fromRe-scan after every deploy plus weekly, with an email when a key leaks or a header regresses. $49 $39/mo for 5 apps.
Opening soon. No payment is taken now. Planned launch prices, shown with the launch sale (20% off through Nov 30, 2026).
Free for the first 5: already fixed what the scan found? Get a free review of your fixes in exchange for honest feedback. Nothing is for sale.
Need a hand?
FAQ
Is the scan free?
Yes. The instant scan is free with no account and no email required, and you see the full report.
Is it safe to run on my production app?
Yes. Unspill is strictly passive: it downloads the same public files a visitor's browser does (your HTML, JavaScript bundles and, if public, source maps), checks two well-known sensitive paths (/.env and /.git/config), and sends one CORS preflight (OPTIONS) request to one API path. It never logs in, never submits forms, and never queries your database. A scan makes at most about 20 requests.
Do you store my results or any keys you find?
No. Scan results are generated on the fly and returned to your browser only. Secrets are masked before they leave the scanner (first few characters and last 4 only), and we never store them. Our hosting logs record that a scan happened (time, hostname) for abuse prevention.
Why doesn't Unspill test my Supabase tables?
Testing whether tables are readable means querying someone's database. Unspill doesn't do that; it tells you when a Supabase project is present and gives you SQL to verify Row Level Security yourself in a couple of minutes, which is also more reliable than an outside guess.
My Supabase anon key / Firebase apiKey was found. Is that a leak?
No. Those are designed to be public. Unspill flags them as a reminder to verify Row Level Security or Security Rules, which are what actually protect your data. A Supabase service_role or sb_secret_ key, however, is a critical leak.
Which apps can I scan?
Only apps you own or have permission to test. Any public http(s) URL on standard ports works, including *.lovable.app, *.bolt.new hosting, *.vercel.app, *.netlify.app and custom domains.
Does a good grade mean my app is secure?
No. A passive scan can't see your database rules, server code, auth logic or whether one user can read another user's data. It catches the common, easy-to-exploit mistakes. For the rest, join the deep audit waitlist.