Online scan

Try Vipe online: scan a vibe-coded app without installing

Upload a project you built with AI coding tools. Vipe reads its JavaScript, TypeScript and SQL for the mistakes those tools make most often: exposed secrets, SQL injection, Next.js routes and server actions with no auth check, Supabase tables without row level security, unverified Stripe webhooks, and code that breaks the build. Your first scan is free and needs no account. For checks while you write, every day, use Vipe for VS Code.

One free scan per IP address. After that a scan uses one credit: 3 scans for $9 or 10 scans for $19.

How it works

Upload, scan, review the fixes

Coverage

What the web scan checks (and what it doesn't)

The web scan reads JavaScript, TypeScript and SQL files. A safety net for the mistakes AI coding tools make most often. Not a full security review, and not a guarantee: no findings does not mean the code is secure. Some checks are certain and shown as errors. Others are likely, because they depend on something one file does not show, and are shown as warnings.

23 security checks

• Hardcoded secret

  A real key format anywhere in a string (Stripe, OpenAI, Anthropic, GitHub, AWS, a private key, a Supabase service-role key), a secret-named variable holding a random-looking value, or a secret read from the environment with a default written in the code.

  Error or warning

• Secret exposed to the browser

  A secret behind a prefix that ships it to every visitor (NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_), in code or in a .env file.

  Error or warning

• Service role key in browser code

  The Supabase service role key, or the admin API that needs it, used in code that runs in the browser.

  Error

• Secret written to logs

  A log statement that prints the whole environment or a secret environment variable as it is.

  Error

• Table without row level security

  In SQL migrations: a public table that no migration enables row level security for, row level security switched off, or a policy that lets anyone write.

  Error or warning

• SQL injection

  A value spliced into the text of a SQL query instead of being passed as a parameter.

  Error

• Unverified Stripe webhook

  A Stripe webhook handler that acts on an event without verifying its signature.

  Error or warning

• Server action without an auth check

  A Next.js server action that changes data without checking who is calling it.

  Warning

• Route handler without an auth check

  A Next.js route handler under an admin path, one that changes a record named by the request, or one that hands out a whole table of users or payments, with no check of who is calling.

  Warning

• Express route without auth

  An Express route on a sensitive path with no authentication middleware.

  Warning

• Token decoded without verification

  Server code that decodes a login token without verifying it, or accepts tokens nobody signed.

  Error or warning

• Insecure session cookie

  A session or auth cookie set without the httpOnly and secure flags.

  Error or warning

• Unsanitized HTML

  Content rendered as HTML (dangerouslySetInnerHTML, innerHTML) that is not a fixed string, sanitized or generated.

  Warning

• Code execution from request input

  eval() or new Function() called with something that comes from a request.

  Error or warning

• Insecure CORS

  Any website allowed to call the API together with cookies or credentials.

  Error

• Weak password hashing

  A password hashed with MD5 or SHA1, or with a fast hash such as SHA-256.

  Error

• Password compared as plain text

  A stored password compared directly with the one that was typed, which means it is stored unhashed.

  Warning

• Guessable token

  A token, a code or a password made with Math.random(), which can be predicted.

  Warning

• Open redirect

  A redirect to an address taken straight from the request, with nothing checking where it leads.

  Error or warning

• Server-side request forgery

  Server code that fetches an address taken straight from the request, so the caller decides which machine the server talks to.

  Error or warning

• Path traversal

  A file read, written or deleted at a path built from a value in the request, with nothing keeping it inside its folder.

  Error or warning

• Command injection

  A shell command (exec, execSync) built from a value in the request.

  Error or warning

• Whole request body stored

  The whole request body written to the database as it came, so the caller chooses which columns are set.

  Warning

3 build checks

• Broken import

  An import of a file or an export that does not exist in the project.

  Warning

• Duplicate definition

  The same name declared twice in one file, or the same Express route registered twice.

  Warning

• Unused code

  An import that is never used, or a function that nothing in the project references.

  Warning

What it does not check

• Whether a signed-in user may see or change a particular record (authorization logic).
• Authentication done in middleware or in another file: a route that is protected there can still be reported.
• Input validation and rate limiting.
• A value from the request that passes through a helper function or another file before it is used: redirects, server-side fetches, file paths, shell commands and database writes are only followed inside one function.
• Languages other than JavaScript, TypeScript and SQL.
• Anything that needs following a value through more than one step of the code.