Free Vibe-Coded App Scanner Online - TestMu AI (Formerly LambdaTest)

What is a vibe-coded app scanner?

A vibe-coded app scanner is a free online check that fetches a public https URL and looks for the gaps AI coding tools tend to ship. You paste the live address. The engine reads headers, HTML, and same-origin JavaScript, then returns a score, a platform fingerprint, and findings with evidence and an AI-ready fix.

Apps built in Lovable, Bolt, Cursor, v0, or Replit often fail in the deployed bundle, not in the chat transcript. A missing RLS policy lives in Supabase. A Stripe live secret shows up only after the host inlines env vars. This scanner starts where an outsider starts, the public URL, and it will not invent a finding it cannot prove.

Why scan a vibe-coded app before you ship?

A demo that logs in and shows rows can still leak those rows to anyone who opens DevTools. Scan the live host before you share it, because the failures below do not break the happy path.

• Secrets in the bundle: Service role JWTs, Stripe sk_live keys, and cloud tokens get compiled into client JS and stay there.
• Missing RLS: A Supabase anon key is public by design. A table that returns rows to that key is a data leak.
• Leftover files: .env, .git/config, source maps, and /debug sometimes ship because the generator never hid them.
• Weak headers: No CSP, no HSTS, and cookies without Secure or HttpOnly are common on first deploys.
• Skip versus fail: If the outside view cannot prove a bug, this tool skips the check instead of padding the report.

How to use the Vibe-Coded App Scanner?

The scan runs against one public URL. You do not install an agent or connect GitHub. Follow these steps:

• Paste a public https URL: Paste a public https URL you are allowed to test. Local and private hosts are refused before any request is sent.
• Choose default or deep scan: Leave deep scan off for a read-only pass, or tick consent if you want cheap canary checks on that same URL.
• Run the scan: Click Scan URL and wait for the score, platform fingerprint, and check grid. Skipped checks stay skipped. They do not count as fails.
• Copy an AI-ready fix: Copy a finding's AI-ready fix into Cursor, Claude, or Lovable, then review the change before you apply it.

Features of the Vibe-Coded App Scanner

The scanner is built for deployed AI apps, not for a source zip. Here are the features of the tool:

• Read-only default: The first pass only fetches and reports. It never posts, logs in, or touches payment flows.
• Consent-gated deep scan: Canaries for reflected XSS, SQL error text, and leftover admin routes run only after you tick consent.
• Secret redaction: Findings show the secret kind, where it sat, and the last four characters. The full value is dropped.
• Platform fingerprint: Headers and assets are used to mark Next.js, Vercel, Lovable, Supabase, and Firebase when those marks are present.
• Check grid: Each check records ran or skipped, latency, and finding count, so a skip is visible and not scored as a fail.
• Shareable result URL: The address bar keeps the scanned URL so you can send the same result link to a teammate.

Use cases of the Vibe-Coded App Scanner

Use this when you have a public preview or production URL and you want a first pass before users arrive. Pair it with sibling tools when you need a narrower check.

• Lovable or Bolt previews: Scan the published host for anon-readable tables and leftover .env files before you send the link to a customer.
• Cursor or v0 deploys on Vercel: Confirm the production domain, not only localhost, because CDN headers and inlined env differ. Follow with the SSL Certificate Checker if TLS age is the only question.
• Header and redirect triage: After a scan flags CSP or a 3xx hop, the HTTP Status Code Checker can replay a single URL with a chosen user agent.
• Password and session hygiene: If cookies look weak, tighten flags here, then test new secrets in the Password Strength Checker.
• Ship-day checklist: Run this URL scan, then the Core Web Vitals Checker and Page Size Checker on the same host so security and weight are not two different days.

TestMu AI maintains this scanner as part of its free online tools. Processing stays on the scan path you start. Page bodies and extracted secrets are not kept after the report is built.

Frequently Asked Questions (FAQs)

What is a vibe-coded app scanner?

A vibe-coded app scanner is a read-only check of a live https URL built with AI coding tools. You paste the public address. The scanner fetches the page, headers, and same-origin scripts, then reports a score, platform fingerprint, and findings with an AI-ready fix.

Does this scanner need my GitHub repo or source code?

No. The scanner never asks for a repo, zip, or source upload. It fetches the same public https URL a visitor would open, plus a short leftover-file list. If a fact cannot be proven from that outside view, the check is skipped instead of guessed.

What does the default scan check?

The default pass looks at security headers, cookie flags, TLS age, leftover files, secrets in HTML and JS, mixed content, SRI, open redirects already in the HTML, and anonymous Supabase or Firebase reads when those clients appear in the bundle.

When should I turn on the deep scan?

Turn deep scan on only when you own the URL or have written permission to test it. That mode adds cheap canaries for reflected XSS, SQL error text, path traversal, leftover admin routes, and URL-accepting parameters. It still never writes to the target.

Why do some checks say skipped instead of failed?

A skip means the scanner could not prove the issue from the outside, or you did not consent to that probe. Skips do not lower the score. Only findings that came back with evidence count against the 0 to 100 score.

Can I scan localhost or a private IP?

No. The allowlist refuses localhost, RFC1918, link-local, metadata IPs, and non-http(s) schemes. That block is there so the tool cannot be pointed at internal hosts. Enter a public https URL that you are allowed to test.

What do I do with an exposed secret finding?

Copy the finding, rotate the key in the provider console, then remove it from the client bundle. A rescan is not enough if the old key still works. Publishable keys stay informational unless they sit next to a dangerous follow-on.

What does this scanner not cover?

It does not run IDOR or BOLA with two accounts, stored XSS, webhook HMAC tests, payment or business-logic abuse, or compliance attestations. Those need a human audit. The report states that so a green skip is not read as a pass.