Fix Me AIFix Me AI questions, answered
What is a Vibe Check?
A free, outside-in scan of your live app. We read the same public page and JavaScript files a visitor's browser downloads, look for leaked keys, missing security headers, Supabase or Firebase setups that need checking, and missing privacy basics, then give you plain-English fixes with copy-paste prompts.
Is it safe? Do you hack my app?
No. The free Vibe Check makes only normal page requests, just like a browser. It never logs in, never sends attack payloads, and never reads your database. Deeper tests in paid audits happen only after you prove you own the app.
Is my Supabase anon key a problem?
Not by itself. Supabase says the publishable/anon key is meant to be public, but only if Row Level Security is switched on with correct policies. The service_role or sb_secret_ key must never be in your frontend.
Do I need to know how to code?
No. Every finding explains what's wrong in plain English and gives you a prompt to paste into Lovable, Bolt, Cursor, Replit or v0 so your AI builder makes the fix.
Which builders do you support?
Any public web app. We've tuned the checks for the usual vibe-coding stacks: Lovable, Bolt, v0, Replit, Cursor, Supabase, Firebase and Stripe.
Is this a security certification?
No. It's an automated best-effort review that catches common, high-impact mistakes. It can miss things, and it's not a penetration test.
What do you do with my data?
We store your email if you join the list, and scan results only as long as needed. Any secret we spot is shown redacted. See the privacy policy for details.
What exactly does the free scanner request?
Your page's HTML, up to 8 JavaScript files from your own domain, robots.txt and sitemap.xml, plus one http:// request to check you redirect to https. It identifies itself as FixMeAI-VibeCheck. It's rate-limited to 5 scans per hour per visitor.