Vibe Code CheckerIs Your App AI-Built and Safe?

"Vibe coding" means building software by prompting AI tools such as Lovable, Bolt, v0, Replit Agent or Cursor, and shipping what they produce with little engineering review. The apps often look finished. The problems sit underneath: exposed keys, open database tables, no tests and code that nobody on the team fully understands.

Kwebby's Vibe Code Checker scans a live website or an uploaded code ZIP and answers two questions: how much of this was generated by AI, and is it safe to run in production? The tool is part of Kwebby's Free Developer Tools.

Key Takeaways

• The checker gives two scores out of 100: a vibe score (how strongly the evidence points to AI-generated code) and a health score (security, code quality and launch readiness).
• You can scan a website URL or upload your project as a ZIP up to 10 MB.
• Fixed checks look for builder fingerprints, exposed secrets, missing database rules, invented npm packages, missing tests, duplicated code, security headers and SEO problems.
• An AI reviewer then reads the code or the page, and its judgement is blended with the fixed checks. The fixed checks carry 60% of each score.
• Website scans fetch only public pages and files. The tool never logs in, never queries your database and never sends test attacks.
• Each device gets one free scan. Your report stays on the page if you come back.

What Is a Vibe Code Checker?

A vibe code checker is a tool that inspects an app for the typical signs of AI-generated code and for the risks that usually come with it. AI builders produce working screens fast. They are less reliable at access rules, secret handling, error handling and tests, because a demo works without them.

Kwebby's checker does not treat AI-built code as bad. Many good products start in Lovable or Bolt. The goal is to show what needs fixing before real users, payments and data arrive.

How the Vibe Code Checker Works

Website URL mode

1. The tool loads your page in a headless browser and takes a screenshot.
2. It downloads the same HTML and JavaScript bundles every visitor's browser downloads, plus robots.txt, the sitemap and up to three inner pages.
3. Fixed checks look for builder hosting and markers (for example .lovable.app domains or Lovable tags), the stack (React, Vite, shadcn/ui, Supabase, Firebase), API keys inside the JavaScript bundles, public source maps, missing security headers, empty server HTML and duplicate page titles.
4. An AI reviewer reads the rendered page and bundle excerpts, then writes the verdict, findings and fix list.

Code ZIP mode

1. You upload a ZIP of your project. The archive is unpacked in memory, checked for zip-bomb tricks and deleted after the scan. Nothing in it is executed.
2. node_modules, .git, build folders and binary files are skipped.
3. Fixed checks look for builder files (lovable-tagger, .bolt/, .replit, Base44 SDK), AI rule files (.cursorrules, CLAUDE.md, AGENTS.md, .windsurfrules), hard-coded secrets, committed .env files, Supabase tables without row-level security, open Firestore rules, API routes without auth checks, missing rate limits, dependency names that do not exist on npm, duplicated code, very large files, missing tests and missing CI.
4. An AI reviewer gets read-only access to the file tree. It opens the files that matter most (entry points, auth, data access, API routes, the largest components) and submits a structured report.

Secrets are masked before any text reaches the AI model, and reports only show the first and last characters of a detected key.

How to Read the Scores

The health score starts at 100 and loses points per finding: 25 for critical, 12 for high, 6 for medium and 2 for low. The AI reviewer's own health rating is blended in at 40%.

A high vibe score with a high health score is a good result: the app was built fast and still holds up. A low health score is the number to act on.

Most Common Problems in Vibe-Coded Apps

Database tables without access rules

Apps built on Supabase or Firebase talk to the database from the browser with a public key. That is safe only when row-level security (RLS) or Firestore rules restrict every table. Missing rules let anyone read or change the data.

Secret keys in browser code

AI tools sometimes put Stripe, OpenAI or service-role keys in client code. Anyone can copy them from the JavaScript bundle and run up charges or read private data.

Invented packages

AI models sometimes suggest npm packages that do not exist. Attackers register those names and wait for installs. This is called slopsquatting.

No tests and no CI

Generated projects rarely include tests. Every change can break sign-in or payments without warning.

Empty HTML for search engines

Single-page apps built with React and Vite send an almost empty HTML file and draw the page with JavaScript. Crawlers that do not run JavaScript, including many AI crawlers, see a blank page.

Tips for an Accurate Scan

Upload source, not a build

Export the project from Lovable, Bolt or GitHub (Code → Download ZIP). A dist or build folder hides the structure the checker needs.

Include your SQL migrations

For Supabase apps, keep the supabase/migrations folder in the ZIP so the checker can verify row-level security.

Remove real secrets first

The checker masks secrets, but the safest upload contains none. If the scan finds a live key, rotate it after you remove it.

Scan the production URL

Scan the address your users visit. Preview links can differ from production.

Common Use Cases

• Founders who built an MVP with an AI builder and want to know if it is safe to launch.
• Agencies and freelancers who inherit an AI-built project and need a quick audit before quoting.
• Investors and buyers checking the state of an app before a deal.
• Developers who want a second opinion on their own AI-assisted code.

Related Kwebby Tools

• HTTP Headers Checker shows the headers your server sends.
• Robots.txt Generator writes a robots.txt file for your site.
• Website Screenshot Generator captures any page at desktop, tablet or mobile size.

Final Thoughts

AI builders get an app on screen in hours. The Vibe Code Checker shows what those hours skipped: access rules, secret handling, tests and search visibility. Run one scan, fix the critical findings first, and launch with fewer surprises.