For apps built with Lovable, Bolt, Cursor & Claude Code
Your AI-built app might be leaking. Find out in a few seconds.
Vigia checks what anyone on the internet can already see: API keys in your JavaScript, a public .env or .git, a Supabase service_role key. Then it gives you the exact prompt to paste back into your AI tool to fix it. Weekly re-checks are coming soon.
Read-only. Only for apps you own. No code access needed.
When a hosting provider reports a breach, big teams rotate their keys within hours. Most side projects never do. Vigia shows you which keys your app exposes, and how to rotate them.
How the free check works
Paste your URL
Confirm the app is yours. We never scan sites without the owner's permission.
We look like a visitor would
We download your public page and the JavaScript it loads, and ask for a few files that should never be public, like .env and .git. Nothing is attacked or changed.
Plain-language report
Each problem explained in one sentence, ranked by severity, with a copy-paste fix prompt for Cursor, Lovable or Bolt.
Fix with a ready-made prompt
Copy a fix prompt into Cursor, Lovable or Bolt. Automatic weekly re-checks are coming soon on Pro.
What Vigia looks for
- OpenAI, Anthropic, Stripe, AWS and other secret keys shipped to the browser
- Supabase
service_rolekey exposed (full database access) - Supabase tables readable without login (RLS off), read test on verified sites coming soon
- Public
.envand.gitfolder source maps — coming soon - Firebase config present, with a reminder to check Security Rules
- Breach radar for hosting providers coming soon
Simple pricing
Prices in euros, VAT included.
Free check
€0
- One public check of your app
- Severity of each issue and top findings
- Fix prompts for each finding
Pro
€12/mo
or €120/year (2 months free). VAT included. Not on sale yet: Pro opens when weekly re-checks go live. Nothing to pay now: join the free waitlist and we'll email you.
- Up to 3 apps
- Weekly re-check + email alerts coming soon
- Supabase RLS read test on verified sites coming soon
- Breach radar and key-rotation checklists coming soon
Agency
€39/mo
For agencies and freelancers who build apps for clients. Not for sale yet — tell us you're interested.
- Up to 10 apps
- Everything in Pro, for each app: weekly re-check + email alerts coming soon
Get early access
Leave your email and we'll send your invite. Nothing to pay now.
We'll only email you about Vigia. Unsubscribe anytime.
Try the free check
Paste the URL of an app you own. Before the first check, you prove it's yours with a small token (we show you how).
Prove you own this site
Before we check a site, we need proof that it's yours. Get a token, publish it in one of the two ways below, then press Verify. We only read that file or your homepage.
Site:
- Option A: a file — publish a text file containing only the token at:
- Option B: a meta tag — paste this inside the <head> of your homepage:
Privacy note
We store your email, the plan you asked about (free, Pro or Agency) and when you signed up, so we can send your invite and product updates. We do not sell your data and we use no tracking cookies. You can ask us to delete your email anytime by replying to any message or writing to customerservice@tryvigia.com. Full details: Privacy Policy.
FAQ
Does Vigia guarantee my app is secure?
No. Vigia is an automated check of the most common mistakes in AI-built apps. It is not a penetration test or a security audit, and a clean report does not mean your app has no vulnerabilities. Think of it as a smoke alarm, not a fire inspection.
Can I scan someone else's site?
No. You must own the app or have written permission. Before we check any site, you prove it's yours by publishing a token we give you: a small file at /.well-known/vigia-verify.txt or a meta tag on your homepage. Deeper tests on verified sites (like reading your Supabase tables) are coming soon.
Do you need access to my code?
No. The free check only looks at what your site already serves to every visitor.
Do you store what you find?
No. Today we don't store check results: the report is generated, shown to you, and not saved on our side. In the report, keys are always masked (first and last 4 characters) so you can recognise them. To prove ownership, we keep the site address, its verification token and when it was verified. If this changes (for example, for Pro weekly re-checks), we'll update this answer first.
Do I pay anything now?
No. Before launch there is only a free waitlist, with no payment. We email you when payments open.