Vibe-Code Security Scanner for Lovable, Cursor and Bolt Apps | Nurbak
Log inCreate account and connect GitHub

VIBE-CODE SECURITY SCANNER

Your vibe-coded app shipped with the door open

AI builders optimize for shipping, not security. Connect the GitHub repo of your Lovable, Cursor, Bolt, v0 or Replit app and Nurbak's AI pentester finds the exposed secrets, missing auth and open database rules in the code. Free scan to start.

Create account and connect GitHub

We never store your code. We only write when you ask for a fix PR.

Exposed secrets

API keys, service-role keys and tokens committed to the code or left in git history.

Missing authentication

Endpoints and server actions that return data without checking who is asking.

Open Supabase RLS

Tables and migrations without Row Level Security policies, so any user can read everyone's data.

Fix it with a PR

Each finding comes with the fix, and Nurbak can open the Pull Request for you. Your first one is free.

How the vibe-code scan works

1

Create your account and connect GitHub.

2

Pick the repo of your app, public or private.

3

Our own AI model reads the code like a pentester, on ephemeral infrastructure.

4

You get a security score and the 3 most important findings in full.

5

Ask for a fix Pull Request, or unlock the full report on a plan.

Vibe-code scanner FAQ

Is the scan free?

Yes. The free scan works on any repository: you see your security score and the 3 most important findings in full, plus 1 fix Pull Request on us. Paid plans unlock the full report and continuous monitoring.

Does it work with Lovable, Cursor, Bolt, v0 and Replit?

Yes, as long as the code is in a GitHub repository. Lovable, Bolt, v0 and Replit can all sync or export the project to GitHub.

What does it check?

Hardcoded secrets (including git history), missing authentication and authorization, Supabase RLS gaps, injection, SSRF, IDOR, vulnerable dependencies and CI misconfigurations.

Is my code safe?

Yes. Analysis runs on ephemeral infrastructure with our own model, your code is never sent to OpenAI or Anthropic, and it is deleted when the scan finishes.

See what's exposed before someone else does

Connect GitHub and get your security score in minutes.

Scan my app's code