Security check for AI-built apps
Paste your GitHub repo or app URL. Get a free security score in under a minute. We flag leaked keys, open databases and unprotected routes. See an example report.
No signup · read-only · we never keep your code. How we handle your code
No signup. We only read. We never run your code or attack your site. We never keep your code, only your report. Reports are saved so you can track progress over time. Delete anytime on request. See the leaderboard
Dependencies · Critical Jump to the full sample report.A public GitHub repo or your live app. No signup.
Free, in under a minute. It’s a first look: the full report may find more.
$19 Full Report: each issue we find, plus a copy-paste AI prompt to fix each one.
One AI prompt can undo last week’s fix. We re-check every week and email you only if something new appears. See plans.
We never keep your code, only your reports. Remove a project, cancel or ask us to delete your data anytime. A fast automated check that catches the most common security mistakes in AI-built apps, so you can ship with more confidence. It isn’t a substitute for a full security audit.
From a real open-source Next.js + Supabase storefront we scanned. Names removed; findings unchanged.
Why it matters: A true policy on write actions means any visitor can insert/update/delete.
43create policy "••••••" on public.•••••• 44 for update 45 using (true);
45- using (true);45+ using (auth.uid() = user_id);
Why it matters: Includes a critical Next.js advisory (image optimization cache-key confusion).
Why it matters: Anyone holding your public anon key (it ships in your frontend) can read or change these tables.
Why it matters: Without a lockfile, every fresh install can pull different package versions, so your app may break on deploy.
Why it matters: Routes like /api/checkout and /api/upload can be called directly, bypassing your UI.
For a one-off check before you launch
For apps you keep changing with AI
Best value for apps you keep shipping
Get a free vibe score · Bought a $19 report? First month of Monitoring free · Auto-Fix coming soon
By buying, you agree to our Terms, Privacy Policy and Refund Policy.
Opt-in scores from paid scans. Only the buyer can add or remove an entry. A score is one automated scan, not a certification.
Sample rankings, live board launching soon.
| # | App | Builder | Score | Built with | Scanned |
|---|---|---|---|---|---|
| 01 | pantry-planner @maya_ships_apps · Cursor · 2026-10-01 | @maya_ships_apps | 92/100 | Cursor | 2026-10-01 |
| 02 | invoice-snap @devon_builds_ai · Lovable · 2026-09-28 | @devon_builds_ai | 88/100 | Lovable | 2026-09-28 |
| 03 | habit-streaks @sam_vibe_codes · Bolt · 2026-09-25 | @sam_vibe_codes | 84/100 | Bolt | 2026-09-25 |
| 04 | tutor-booking @leo_prompt_dev · v0 · 2026-09-20 | @leo_prompt_dev | 81/100 | v0 | 2026-09-20 |
| 05 | gym-log-pwa @noor_makes_apps · Claude · 2026-09-18 | @noor_makes_apps | 77/100 | Claude | 2026-09-18 |
Yes. Paste a public GitHub repo or your live app’s URL and get a preliminary score on the page, usually in under a minute. No signup, no email, no card. It’s a first look: the $19 report checks more and may find more.
No. We download a temporary copy, scan it, and delete it right after. We keep only your report: the repo or site URL, score and findings (file names and line numbers, never code). Secrets we find are masked. We never train AI on your code or share it. To delete all your data, email support@cheqvo.com.
Yes. Paste it in the scan box and choose “Connect GitHub”, then check out (same prices). You install our read-only GitHub App on just the repos you choose. For each scan we use a temporary copy with a one-hour token and delete it right after. With a Full Report, private repos are also re-scanned automatically after each push to your default branch; these count toward your 10 re-scans within 30 days. Uninstall the app in GitHub settings any time to stop.
A one-time report for one repo or site: each issue we find, explained simply, with a copy-paste AI prompt to fix each one. Up to 10 free re-scans within 30 days via the link in your report email (max one per hour), a README badge if you score 80+, and a full refund if the scan fails. Emailed within minutes. A site report checks from the outside, like a visitor; a repo report goes deeper (code, database rules and packages).
$12/month or $99/year. We re-check up to 3 repos or sites every week and email you only if something gets worse, with the AI fix. Plus a monthly report and re-scans any time (once an hour). Yearly also includes priority email support and early access to Auto-Fix when it launches. Cancel any time in the customer portal linked in every email; Monitoring runs until the end of your paid period.
No. A fast automated check that catches the most common security mistakes in AI-built apps, so you can ship with more confidence. It isn’t a substitute for a full security audit. Like any automated check, it may miss issues, so apps handling sensitive data still need a professional review.
Yes. VibeCheck is now called Cheqvo. Your reports, re-scan links, badges and Monitoring keep working, and old getvibecheck.dev links redirect to cheqvo.com.
Get notified when Auto-Fix launches.
