No. The scan runs in your browser and nothing is sent to a server.

What does the scanner find?

Leaked API keys such as Stripe, OpenAI and Supabase service keys, open CORS, unsafe innerHTML and missing security headers.

What should I do if a key is found?

Rotate the key with the provider first, then remove it from the code and the git history.

For apps built with Cursor, Lovable, Bolt or v0

Vibe-Coded App Security Scanner: find leaked API keys in 10 seconds

Paste a file, .env or config. The scanner flags leaked keys, public env prefixes, open CORS, disabled RLS and missing headers. Runs in your browser, nothing is uploaded.

✓ Runs 100% in your browser✓ Free score, no signup✓ Instant download after checkout✓ Free terminal scanner

❌ Legacy / Vulnerable Code

✅ PatchVault Auto-Fixed Code

—Time saved (est.)

—Engineering cost saved (est. @ $75/h)

Unlock Full Auto-Fixer + Cursor Skill — $9 →🏷️ White-label + client reports — $29

Or scan your whole repo locally (Python 3, stdlib only):

$python3 <(curl -sL https://patchvault-81y.pages.dev/starters/vibe-security-scan.py)

Estimate: 1.5 h per CRITICAL, 1.0 h per HIGH, 0.5 h per MEDIUM issue (find, rewrite, re-test by hand). Nothing you paste leaves this tab.

Before: key in client code

const stripe = Stripe('sk_live_51H...')
NEXT_PUBLIC_OPENAI_KEY=sk-proj-...

After: key server-side

const stripe = Stripe(process.env.STRIPE_SECRET_KEY)
# .env is gitignored, pre-commit hook blocks leaks

~~$29~~$9one-time, no subscription. 10-second fix bundle. Get the fix bundle

100% Working Patch Guarantee — full refund if it doesn't pass your build check
Refund requests: open a Discussion at patchvault-81y.pages.dev

The math: One leaked OpenAI or AWS key can be drained for $500 to $5,000 overnight. The bundle is $9 and moves secrets out of code in one command.

Key Takeaways

AI-built apps often ship secret keys in front-end code, where anyone can read them.
The free scanner runs in your browser and flags keys and risky patterns without uploading your code.
The $9 bundle adds the fix steps, a pre-commit secret check and a key-rotation checklist.

Free instant diagnostic: your Readiness Score

What the $9 bundle contains

secure.js: scan plus --fix that moves secrets to process.env and writes .env.example
Pre-commit hook that blocks new leaks
Security header templates for Vercel, Netlify, Next.js, nginx
Key rotation guide and AI repair prompts

Who this is NOT for

Teams with a security engineer and secret scanning in CI
Apps with no API keys at all
Anyone needing a pentest or compliance audit (this is not one)

Security fix: this bundle vs by hand

	This tool	Manual / ChatGPT
Finds every issue	Yes, file and line	Misses files you did not paste
Time	About 10 seconds	1 to 3 hours
Cost	One-time fee	Your hourly rate
Runs offline	Yes	No

Run Free 10-Second Terminal Scan

Paste this in your project folder. One Python 3 file, standard library only, nothing is uploaded. It checks for leaked keys, public secrets and open CORS and prints a 0-100 score.

python3 <(curl -sL https://patchvault-81y.pages.dev/starters/vibe-security-scan.py) .

View the script

leaked API keys: which option is best suited for you

Option	Best Suited For	Cost
Free scanner on this page	A quick check before you launch	Free
$9 fix bundle	Solo builders who want the fix steps and a pre-commit check	$9 one-time
gitleaks / trufflehog	Teams comfortable setting up a CLI in CI	Free, more setup
A paid security audit	Apps that handle payments or health data	$$$

Exact errors this fixes

Error: Incorrect API key provided / quota exceeded

Often a leaked key being used by someone else. Rotate it, then the bundle moves it server-side.

GitGuardian: secret detected in your repository

The fixer removes it from code and installs a pre-commit hook.