For apps built with Lovable, Bolt, Cursor & Claude Code
Your AI-built app might be leaking. Find out in a few seconds.
Vigia checks what anyone on the internet can already see: API keys in your JavaScript, a public .env or .git, a Supabase service_role key. Then it gives you the exact prompt to paste back into your AI tool to fix it. Weekly re-checks are coming soon.
Read-only. Only for apps you own. No code access needed.
When a hosting provider reports a breach, big teams rotate their keys within hours. Most side projects never do. Vigia shows you which keys your app exposes, and how to rotate them.
How the free check works
Paste your URL
Confirm the app is yours. We never scan sites without the owner's permission.
We look like a visitor would
We download your public page and the JavaScript it loads, and ask for a few files that should never be public, like .env and .git. Nothing is attacked or changed.
Plain-language report
Each problem explained in one sentence, ranked by severity, with a copy-paste fix prompt for Cursor, Lovable or Bolt.
Fix with a ready-made prompt
Copy a fix prompt into Cursor, Lovable or Bolt. Automatic weekly re-checks are coming soon on Pro.
What Vigia looks for
- OpenAI, Anthropic, Stripe, AWS and other secret keys shipped to the browser
- Supabase
service_rolekey exposed (full database access) - Supabase tables readable without login (RLS off), read test on verified sites coming soon
- Public
.envand.gitfolder source maps — coming soon - Firebase config present, with a reminder to check Security Rules
- Breach radar for hosting providers coming soon
Simple pricing
Free check
€0
- One public check of your app
- Severity score and top findings
- Fix prompts for each finding
Pro
€9/mo
founder price during the test for 3 months, then €19/mo. Fully refundable before launch.
- Up to 3 apps
- Weekly re-check + email alerts coming soon
- Supabase RLS read test on verified sites coming soon
- Breach radar and key-rotation checklists coming soon
Studio
€49/mo
For agencies and builders with several apps. Not for sale yet — tell us you're interested.
- Up to 10 apps
- Weekly checks + priority alerts coming soon
- Shared team inbox for findings
- Priority support when we launch
Get early access
Join during the validation test to lock in founder pricing. Leave your email and we'll send your invite.
We'll only email you about Vigia. Unsubscribe anytime.
Try the free check
Paste the URL of an app you own. Before the first check, you prove it's yours with a small token (we show you how).
Prove you own this site
Before we check a site, we need proof that it's yours. Get a token, publish it in one of the two ways below, then press Verify. We only read that file or your homepage.
Site:
- Option A: a file — publish a text file containing only the token at:
- Option B: a meta tag — paste this inside the <head> of your homepage:
Privacy note
We store your email, the plan you asked about (free, Pro or Studio) and when you signed up, so we can send your invite and product updates. We do not sell your data and we use no tracking cookies. You can ask us to delete your email anytime by replying to any message or writing to customerservice@tryvigia.com. Full details: Privacy Policy.
FAQ
Does Vigia guarantee my app is secure?
No. Vigia is an automated check of the most common mistakes in AI-built apps. It is not a penetration test or a security audit, and a clean report does not mean your app has no vulnerabilities. Think of it as a smoke alarm, not a fire inspection.
Can I scan someone else's site?
No. You must own the app or have written permission. Before we check any site, you prove it's yours by publishing a token we give you: a small file at /.well-known/vigia-verify.txt or a meta tag on your homepage. Deeper tests on verified sites (like reading your Supabase tables) are coming soon.
Do you need access to my code?
No. The free check only looks at what your site already serves to every visitor.
Do you store what you find?
No. Today we don't store check results: the report is generated, shown to you, and not saved on our side. In the report, keys are always masked (first and last 4 characters) so you can recognise them. To prove ownership, we keep the site address, its verification token and when it was verified. If this changes (for example, for Pro weekly re-checks), we'll update this answer first.
How is the pre-reservation refunded?
If we don't launch, or you change your mind before launch, you get a full refund. Just reply to the receipt email.