VibeScale

VibeScale checks apps built with AI coding tools for the security gaps those tools commonly leave. With VibeScale connected, Claude or Claude Code can:

• Scan one public web app the way a browser reads it (its HTML, the same-site scripts it loads and the source maps they point to) and report what any visitor can already see: server secret keys shipped to the browser (Supabase service_role, OpenAI, Anthropic, Stripe, AWS, GitHub, SendGrid, Resend; shown masked), a published source map, no HTTPS, and missing Content-Security-Policy, HSTS or frame protection. It does not sign in, guess paths or query the app's database.

• Read Supabase SQL (migrations or a schema dump) as text and list tables without row level security, RLS without a policy, policies that allow everything or read user_metadata, policies without a role, write grants to anon, SECURITY DEFINER functions and views, new tables without a grant and public storage buckets, each with the SQL that fixes it. The SQL is never executed.

• Take environment variable names (never values) and say which ones the build tool ships to every visitor (VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_ and others) and which of those look like a server secret.

Findings and explanations are written in Hebrew; tool names, keys and SQL stay in English. Each answer ends with one link to the matching tool on vibe.elya-studio.com. Inputs are used only to answer; a scan result is kept in server memory for up to an hour so the same site is not scanned twice. Nothing is changed and nobody is contacted.