# LockYourVibe

> LockYourVibe (https://lockyourvibe.com) is a security scanner for vibe-coded web apps: apps built quickly with AI tools such as Cursor, Lovable, Bolt, and v0. A visitor pastes a public URL they confirm they own. The free scan is read-only and returns an A–F grade, plain-English findings, and a copy-paste fix prompt for Cursor or Lovable.

LockYourVibe does not require an account for the free scan. It does not modify the target application. It blocks scans of localhost and private IP addresses.

## What the free quick scan checks

- Exposed secrets in the HTML and same-origin JavaScript: OpenAI keys, Stripe sk_live and rk_live, AWS access key ids and secret access keys, GitHub tokens, Supabase service_role JWTs, Firebase admin keys, and PEM private keys.
- Public files that should not be served: /.env, /.git/config, /.git/HEAD, and JavaScript source maps.
- Security headers: Content-Security-Policy, Strict-Transport-Security on HTTPS, clickjacking protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
- A Supabase URL plus anon key, followed by a non-destructive GET of a few common table names. Rows coming back means those tables are readable without a login. The service_role key is never used for that request.

## Pricing

- Free quick scan: no account.
- Full report: $19 at launch, $29 after. Stripe Checkout charges the $19 price when STRIPE_SECRET_KEY and STRIPE_PRICE_ID are set. The success page checks the Checkout Session with the Stripe API and shows the report only when payment_status is paid. The paid scan repeats the free checks and adds more exposed files, a source-map secret search, Supabase and Firebase rule probes, CORS, and the rest of the header checks. Every finding has a fix prompt. The report can be printed or downloaded. Refunds within 7 days by emailing hello@lockyourvibe.com. If the Stripe keys are missing, the buy button stays closed and no card is charged. An optional webhook at /api/stripe/webhook runs only when STRIPE_WEBHOOK_SECRET is set.

## Safety rules

- The visitor must confirm they own the app or have permission to scan it.
- Requests are HTTP GET only.
- Private IPs, localhost, link-local addresses, and cloud metadata hostnames are refused.
- Raw secret values are redacted in the report. The share link contains the redacted findings, not a copy stored in a database.

## Pages

- [Home](https://lockyourvibe.com/): URL form, how it works, pricing, FAQ, newsletter
- [Sample report](https://lockyourvibe.com/results?sample=1): demo findings from a fake app
- [Terms](https://lockyourvibe.com/terms): scan authorization and no-warranty language
- [Privacy](https://lockyourvibe.com/privacy): what the scan stores

## Contact

hello@lockyourvibe.com