Download$19
Supabase RLS Checker
Supabase RLS checker for migrations: tables without RLS, using (true) policies, user_metadata, slow auth.uid(), definer views. Fix SQL included. $19.
View Supabase RLS CheckerVibe Coding Security Audit
Find the leaked API key, the open database route and the fake-payment webhook before someone else does, with the exact fix for each.
What it does
You built the app fast with Cursor, Claude Code, Lovable, Bolt or v0. This kit finds the security holes those apps ship with most often, explains each one in plain words, and tells you (or your AI assistant) exactly how to fix it, before someone finds your OpenAI key or empties your database.
One command: python3 -m vibeaudit path/to/your/app gives a grade (A-F), every problem with file and line, and the fix. Python 3.9+, standard library only, nothing leaves your computer.
What you get
The screenshot is real output from the kit’s own commands. Tested from a fresh download of this exact zip: ./run_tests.sh ran 11 tests OK on Python 3.13 and 3.10.
What it checks
| Id | Problem | Why it matters |
|---|---|---|
| VS001 | API keys in code: Stripe live, OpenAI, Anthropic, AWS, GitHub, Slack, Resend, SendGrid, private keys, database URLs with passwords | anyone with the repo or bundle can use them |
| VS002 | secrets with a browser prefix (NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_, PUBLIC_, NUXT_PUBLIC_) or read from client components | the bundler ships them to every visitor |
| VS003 | .env files not in .gitignore (error if already committed) | the classic leaked-keys-on-GitHub incident |
| VS004 | API routes (Next.js app/pages router, SvelteKit, Nuxt) that change data or hit the database with no auth check | anyone with the URL can call them |
| VS005 | Stripe/Clerk/GitHub/Paddle webhooks without signature verification | fake "payment succeeded" events |
| VS006 | CORS * (or origin: true with credentials) | other sites can call your API as your users |
| VS007 | SQL built from template strings / f-strings / concatenation | SQL injection |
| VS008 | dangerouslySetInnerHTML, innerHTML, v-html, {@html} | XSS, including from AI output |
| VS009 | eval, new Function, shell commands from strings | remote code execution |
| VS010 | JWT decoded without verifying, none algorithm, guessable secrets | forged logins |
| VS011 | DEBUG = True, app.run(debug=True) | error pages leak code and settings |
| VS012 | Supabase service_role key in public env vars, client code or hardcoded (JWT role decoded) | bypasses all Row Level Security |
| VS013 | Firebase allow read, write: if true and public Realtime Database rules | the whole database is public |
| VS014 | login, signup, OTP and AI endpoints without a rate limit | brute force and surprise AI bills |
| VS016 | browser code calling OpenAI/Anthropic/Gemini/Groq directly | the API key ships to the browser |
Use
python3 -m vibeaudit . # text report, exit 1 on errors
python3 -m vibeaudit . --format md --out SECURITY-AUDIT.md
python3 -m vibeaudit . --format json --min-level warning- ./demo.sh audits a fictional broken app (grade F, 8 errors) and the fixed version (grade A).
- hooks/pre-commit blocks commits that add errors.
- skills/vibe-security-audit/SKILL.md is a Claude Code skill (also installable as a plugin): Claude runs the scan, fixes issues in priority order, tells you which keys to rotate, and walks the manual checklist (IDOR, server-side roles, uploads, AI prompt injection, payments).
- ./run_tests.sh runs the 11 tests.
Honest limits
- Pattern-based static checks. It can't prove an app is secure, can't test the running site, and doesn't understand your business rules; the manual checklist covers what it can't see.
- Auth detection looks for common helpers (Auth.js, Clerk, Supabase, Lucia, Firebase, JWT); a custom check with another name shows as a warning you can ignore.
- It doesn't check dependencies for known CVEs (run npm audit / pip-audit) or Supabase RLS policies in depth (see the Supabase RLS Checker).
- Not affiliated with Vercel, Supabase, Stripe, OpenAI, Anthropic, Google or any vendor. Not a penetration test or a compliance certification.
Related: Supabase RLS Checker: https://youraitools.co/marketplace/supabase-rls-checker. GitHub Actions Security Checker (free): https://youraitools.co/marketplace/github-actions-security-checker
Format and license
Zip, 20 KB, v1.0, 24 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with or endorsed by Vercel, Supabase, Stripe, OpenAI, Anthropic, Google or any vendor.
FAQ
- Does it upload my code?
- No, it runs on your computer and never connects to the network.
- Which stacks?
- Next.js, React/Vite, SvelteKit, Nuxt, Expo, Express, Python (FastAPI, Flask, Django) and Firebase/Supabase projects.
- Is this a penetration test?
- No. It's a static check plus a manual checklist; for regulated or high-risk apps, hire a security professional too.
- How do I get the files?
- Pay by card right here on youraitools.co: your download links appear on this page the moment the payment goes through (claim window: 72 hours, up to 5 downloads per 7 days). Need the files re-sent later? Email hello@youraitools.co.
- Refunds?
- Email hello@youraitools.co within 14 days if it doesn’t work and we can’t fix it.
- Can I pay with crypto?
- Yes. Pay the same price in USDC or USDT on Base, Ethereum, Arbitrum, Optimism, Polygon or Solana from the "Pay with crypto" button, with no account or KYC. We check the payment on-chain and show your download links as soon as it confirms.
Get Vibe Coding Security Audit
Security audit for AI-built apps: exposed API keys, NEXT_PUBLIC secrets, Supabase service_role, open API routes, Stripe webhooks, CORS. Grade + fixes. $29.
Save with a bundle
- Ship-Safe Security Bundle: 3 products for $45 ($67 separately, you save $22).
Pairs well with
Download$19
Dockerfile Linter & Best Practices Checker
Dockerfile linter with fixes: non-root user, pinned slim images, secrets in ENV/ARG, apt cache, COPY order, .dockerignore. SARIF + Claude Code skill. $19.
View Dockerfile Linter & Best Practices CheckerDownloadFree
GitHub Actions Security Checker (Free)
Free GitHub Actions security checker: script injection, pull_request_target, unpinned actions, token permissions and secrets, with fixes. Offline, SARIF.
View GitHub Actions Security Checker (Free)Related
1 email a week: new x402 + MCP tools and free kits.
Short weekly digest of new x402 + MCP tools and free kits, including the MCP OAuth Checker. No spam, unsubscribe any time.