Question 1

What does VibeShield do?

Accepted Answer

It scans your live app the way an attacker would look at it from the outside — exposed keys, open Supabase tables, missing security headers, exposed files and more — then tells you how serious each issue is and how to fix it. Signed-in scans also audit accessibility, SEO & AEO (AI visibility for answer engines), and what your page ships — all in one report.

Question 2

Do you need my login or database credentials?

Accepted Answer

No. VibeShield only ever uses your public URL, exactly what any visitor or attacker can reach. We never ask for or store login credentials for the apps you scan.

Question 3

Is scanning safe for my app?

Accepted Answer

Yes. Scans are passive and read-only by default. Pro and Business optional active checks send a small number of crafted but non-destructive requests — no data is changed, no passwords are guessed, and nothing is overloaded. Only scan apps you own or are authorized to test.

Question 4

What is SEO & AEO / AI visibility?

Accepted Answer

Alongside classic on-page SEO (titles, meta, structured data, robots/sitemap), we check whether answer engines can find and cite you — things like llms.txt, whether robots.txt blocks ChatGPT/Claude/Perplexity search crawlers, thin text, and nosnippet directives. We don't query ChatGPT about your brand; we check the technical signals those systems need to crawl and cite your site.

Question 5

How do you check my Supabase database without access to it?

Accepted Answer

Your app already ships its Supabase URL and public key to every visitor. VibeShield uses them to ask Supabase how many rows each table would return — the row count only, never the data. If the public key can count your users table, anyone can download it, which usually means Row Level Security is off.

Question 6

I built my app with Lovable, Bolt, v0, Cursor or Replit. Does it work?

Accepted Answer

Yes — VibeShield works with any public web app, and its checks target the mistakes most common in apps those tools generate, like Supabase RLS gaps and API keys shipped to the browser.

Question 7

How do I fix what it finds?

Accepted Answer

Every finding explains the fix in plain English, and has a “Copy AI fix prompt” button that gives you a ready-made prompt for the tool you build with. Paste it in, then use “Re-scan to verify fixes” to confirm the issue is gone. Pro also includes a one-click fix-everything prompt.

Question 8

What's the difference between Free, Pro, and Business?

Accepted Answer

Free (Basic): Security + Accessibility, AI fix prompts, 3 scans/month, 1 project. Pro ($19/month): all four tools, active attack checks, weekly schedules, email alerts, PDF/JSON + white-label, fix-everything prompt, 50 scans across 3 projects. Business ($39/month): daily schedules, deploy webhooks, Slack/Discord/ClickUp, GitHub scanning + PR comments, API keys, AI remediation assistant, 150 scans across 10 projects.

Question 9

Is the first scan without signup a full audit?

Accepted Answer

The instant scan on the homepage is a free security-only pass with no account. Create a free account to run Security, Accessibility, SEO & AEO, and Bundle & Tech together on every scan.

Question 10

Does a clean report mean my app is secure?

Accepted Answer

No scanner can promise that. A clean report means none of VibeShield's checks found an issue at that moment. Keep scanning after changes — every new prompt can change your app.

Question 11

How do I cancel a paid plan?

Accepted Answer

In Settings → Plan & billing, use Manage subscription or Cancel subscription (Paddle's customer portal), or the link in any Paddle receipt. Your plan stays on until the end of the month you've paid for, then your account moves to Free. Your scan history stays.

Questions, answered