Ship the vibe. Not the breach.
Your AI wrote the code. It did not check whether the API key made it into the browser. Vibe Guard scans your live site for security, SEO and AI-visibility problems — then writes the fix for every single one.
Read-only probes · no signup · results in under 60 seconds
Scans whatever you shipped it with
Everything that can quietly ruin a launch.
Most tools check one of these and leave you to discover the rest the hard way. Vibe Guard runs all four against your live site in a single pass.
Security
The stuff that ends companies. Leaked keys in your bundle, a readable /.env, wide-open CORS, no CSP.
- API keys & tokens in client code
- Publicly readable /.env and /.git
- Missing CSP, HSTS, X-Frame-Options
- Wildcard CORS & version disclosure
SEO
The reason nobody found the thing you built. Crawl blockers, missing metadata, no sitemap.
- robots.txt blocking your whole site
- Missing titles, descriptions, canonicals
- Heading structure & alt coverage
- Sitemap presence and validity
AEO
Buyers ask ChatGPT before they ask Google. We test whether assistants can actually read and cite you.
- Structured data (JSON-LD) coverage
- Content readable without JavaScript
- llms.txt and Open Graph completeness
- GPTBot / ClaudeBot crawl access
Performance
Slow is a bug. We measure what your visitors actually wait for, and what is making them wait.
- Time to first byte
- Compression & cache headers
- Render-blocking scripts
- Document payload weight
A report you can't act on is just anxiety.
Knowing you have “a missing Content-Security-Policy” helps nobody if you did not write the code in the first place. Every Vibe Guard finding comes as a prompt written for the tool you already build with.
Copy one finding, or copy a single prompt that resolves the entire report — ordered so your agent fixes the critical issues before it touches the cosmetic ones.
See it on your own siteMy site ships a Supabase service_role key in the client bundle. Move it to a server-side environment variable, call Supabase only from server code, rotate the exposed key, and replace the client usage with the anon key plus row-level security policies.
Three steps. About a minute.
Paste a URL
Production, staging, or the prototype you shipped at 2am. No agent to install, no code to change, no signup to get your first report.
Get ranked findings
Every probe runs in parallel and comes back in under a minute, ordered by what will actually hurt you first — not alphabetically.
Paste the fix back
Each finding ships as a prompt written for your AI editor. Copy one, or copy a single prompt that fixes everything at once.
Regression alerts
We re-scan daily and email you the moment a score drops — not a month later.
Repo scanning
Connect GitHub for dependency, secret-history and static analysis on the source itself.
MCP server
Run scans and pull findings straight from Claude, Cursor, Codex or any MCP client.
Client-ready exports
Every report as PDF or Markdown, for handoffs, invoices and paper trails.
Same scan. No paywall on the truth.
Most scanners show you a score, blur the findings and ask for a card. We think finding out you leaked a production key should never be a paid feature.
If you ship faster than you audit.
You shipped it. Nobody checked it.
The AI wrote the auth flow, the API routes and the database policies. It did not tell you the service key ended up in the client bundle.
One scan before every handoff.
Client MVPs go out on brutal deadlines. Attach a clean report to the invoice and stop inheriting problems you did not create.
Catch regressions, not incidents.
A header disappears in a refactor and nobody notices for six weeks. Daily re-scans tell you the same day the score drops.
Invisible storefronts do not sell.
Blocked crawlers, missing schema and a two-second TTFB quietly cost more revenue than any redesign will ever win back.
“Ran it on a client site I'd already handed off. Supabase service key sitting in the page source. I have never fixed something so fast.”
“I assumed my Claude-written API routes were fine because they worked. The report found four issues and handed me the prompts. Twenty minutes, all closed.”
“The AEO section explained something nobody else had: ChatGPT couldn't read our site at all because everything rendered client-side.”
Scanning is free. Always.
You pay for us to keep watching — not for permission to see what we found.
Free
Everything you need to find out how bad it is.
- Unlimited manual scans
- Full findings — nothing blurred
- Paste-ready fix prompt per finding
- Security, SEO, AEO & performance
Guard
For the site you actually depend on.
- Everything in Free
- Daily automated re-scans
- Regression alerts when a score drops
- GitHub repo & dependency scanning
- MCP server + REST API access
- PDF & Markdown exports
Agency
For everyone shipping on someone else's behalf.
- Everything in Guard
- Up to 25 projects
- White-labelled client reports
- Uptime monitoring & status pages
- Priority support
Common questions.
Is the scan safe to run against a live site?
+
Yes. Every probe is a read-only GET against content that is already publicly reachable. Vibe Guard never submits forms, never writes data and never attempts an exploit. It is the same traffic a search engine crawler produces.
Do I need to install anything or connect a repo?
+
No. Paste a URL and the scan runs against your live site immediately. Connecting GitHub is optional and only needed for source-level checks like dependency and secret history scanning.
What exactly is AEO?
+
Answer Engine Optimisation. It measures whether ChatGPT, Claude and Perplexity can find, parse and cite your site when someone asks them a question in your category. It is a different problem from SEO: assistants mostly do not run JavaScript, so a client-rendered page can rank on Google and still be completely invisible to them.
How is this different from CheckVibe and other scanners?
+
Two things. First, your entire first report is free and unblurred — no paywall between you and finding out you leaked a key. Second, every finding is written as a prompt for your AI editor, and you can copy one prompt that resolves the whole report in a single pass.
Will it find everything?
+
No scanner will, and any tool promising otherwise is selling you something. Vibe Guard covers the misconfigurations and exposures that account for the overwhelming majority of incidents on fast-shipped apps. It is not a substitute for a manual penetration test on a system handling serious money or sensitive data.
What do the paid plans add?
+
The scan itself stays free. Paid plans add continuous monitoring — daily re-scans, alerts the moment a score regresses, repo scanning, API and MCP access, and exportable reports for clients and auditors.
Find out what you shipped.
Scan your site free right now — or leave your email and we'll tell you the day monitoring, repo scanning and the MCP server go live.