What we check

One scan.
Everything that can hurt you.

Security first, because that's what gets AI-built apps breached. Then everything a great launch needs. Every finding comes with the evidence, a one-line command to reproduce it, and the fix.

01

Security holes

CSP, clickjacking, cookies and JWTs, CORS, verbose error pages, input reflection, login-form hygiene, across your key pages.

Scan for this
02

Leaked secrets

Stripe, OpenAI, AWS and database keys hiding in your JavaScript or your repo, plus exposed .env and .git files.

Scan for this
03

Open databases

The #1 killer: Supabase or Firebase tables anyone can read without logging in. We test it directly.

Scan for this
04

Vulnerable dependencies

Libraries on the live site and in package.json checked against the OSV database, with the version to upgrade to.

Scan for this
05

TLS, APIs & exposure

Certificate validity and expiry, GraphQL introspection, public cloud buckets, debug and metrics endpoints, CDN protection.

Scan for this
Vigil only

Attack surface

Every subdomain in certificate-transparency logs, forgotten staging hosts, admin tools on the public internet and dangling DNS open to takeover.

Scan for this
Vigil only

API connections

Every external service your app talks to — payments, auth, database, AI, analytics — classified, with plaintext endpoints and consent gaps flagged.

Scan for this
Vigil only

Repo & PR scanning

Point Vigil at a GitHub repository: secrets in source, risky code patterns, missing RLS, config hygiene and dependency CVEs, before they ship.

Scan for this
Vigil only

AI security review

A second read of your shipped code by a senior-reviewer model: client-side authorization, debug left on, weak sign-in flows. Every finding quotes its evidence.

Scan for this
10

AI visibility

Can ChatGPT, Claude and Perplexity find and recommend you? llms.txt, crawlability and quotable content.

Scan for this
11

SEO readiness

Titles, meta, Open Graph, structured data, sitemap and robots, so Google actually shows you.

Scan for this
12

Speed, email, domain

TTFB and caching, Core Web Vitals, SPF/DKIM/DMARC strictness, domain expiry, consent and policy pages.

Scan for this

Built for how you ship.

Whether you vibe-coded it over a weekend or run a team, the risks are the same. The fixes are tailored to your stack.

Catch what the AI left behind

Leaked keys, open Supabase tables and missing headers are the three ways vibe-coded apps get breached. We test all three directly.

Vigil · AI-built apps

Fix with the tool you built with

Every finding ships as a prompt for Cursor, Claude Code, Lovable or v0. Paste, apply, re-scan.

Vigil · AI-built apps

One Fix Pack, prioritised

A single consolidated prompt that fixes everything in the right order, tailored to your detected stack.

Vigil · AI-built apps

Watch every deploy

Monitoring re-scans on a schedule and alerts you the moment a new secret or open table appears.

Vigil · AI-built apps

See it on your own app.

Fifteen seconds. First scan free with an account.

https://

Free account · first scan free · ~15 seconds · We never store detected keys