For apps built with Lovable, Bolt, Cursor & Claude Code
Your AI-built app might be leaking. Find out in a few seconds.
Vigia checks what anyone on the internet can already see: API keys in your JavaScript, a public .env or .git, a Supabase service_role key. Then it gives you the exact prompt to paste back into your AI tool to fix it. Pro re-checks your app every week.
Read-only. Full checks only for apps you own. No code access needed.
When a hosting provider reports a breach, big teams rotate their keys within hours. Most side projects never do. Vigia shows you which keys your app exposes, and how to rotate them.
How the free check works
Paste your URL
Confirm the app is yours to get the full check. Without proof, we only run a limited summary.
We look like a visitor would
We download your public page and the JavaScript it loads, and ask for a few files that should never be public, like .env and .git. Nothing is attacked or changed.
Plain-language report
Each problem explained in one sentence, ranked by severity, with a copy-paste fix prompt for Cursor, Lovable or Bolt.
Fix with a ready-made prompt
Copy a fix prompt into Cursor, Lovable or Bolt. Pro re-checks automatically every week.
What Vigia looks for
- OpenAI, Anthropic, Stripe, AWS and other secret keys shipped to the browser
- Supabase
service_rolekey exposed (full database access) - Supabase tables readable without login (RLS off), read test on verified sites coming soon
- Public
.envand.gitfolder source maps — coming soon - Firebase config present, with a reminder to check Security Rules
- Breach radar for hosting providers coming soon
Simple pricing
Prices in euros, VAT included.
Free check
€0
- One public check of your app
- Severity of each issue and top findings
- Fix prompts for each finding
Pro
€12/mo
or €120/year (2 months free). VAT included. Cancel anytime.
- Up to 3 apps (one site each)
- Weekly re-check + email alerts
- Supabase RLS read test on verified sites coming soon
- Breach radar and key-rotation checklists coming soon
Agency
€39/mo
For agencies and freelancers who build apps for clients. Not for sale yet — tell us you're interested.
- Up to 10 apps
- Everything in Pro, for each app: weekly re-check + email alerts coming soon
Get Vigia updates
The free check and Pro are available now and don't need this. Leave your email if you want us to tell you when the Agency plan or a check marked “coming soon” launches.
We'll only email you about Vigia. Unsubscribe anytime.
Try the free check
Paste the URL of an app you own. Before we check it, you prove it's yours with a small token (we show you how).
Summary check — read before you run it
We'll read only this site's robots.txt, its homepage and up to 6 JavaScript files the homepage loads — only public files a visitor's browser would load — and tell you only whether we found something that needs attention. We don't run this check if robots.txt blocks the whole site or the homepage, and we skip any JavaScript file it blocks. We follow its rules for VigiaWorker or, if it has none, its rules for all bots. We won't show details or check anything else until you prove you own the site.
We keep the domain, the time and the result shown for 30 days, and a scrambled form of your IP for 7 days, to prevent abuse. Site owners can ask us to exclude their domain. Terms · Privacy
Prove you own this site
Before we show details or check anything beyond the homepage, we need proof that the site is yours. Get a token, publish it in one of the ways below, then press Verify. We only read that file or your homepage (or, with Option D, send one email). After that, only this browser tab can run the full check on the site, for 24 hours.
Site:
- Option A: a file — publish a text file with the token on its own line at:
- Option B: a meta tag — paste this inside the <head> of your homepage; it doesn't count anywhere else on the page (on Base44: inside the <head> of index.html in Dashboard → Code on paid plans, or ask the Base44 AI chat to add exactly this tag to the <head> of index.html on the free plan, then publish):
- Option C: a line of visible text — for builders that let you add your own HTML to the page (for example an HTML or embed block) but not its files or <head>.
Add this exact HTML to your homepage, in an area only you can edit (for example the footer) — not in comments, reviews or any field visitors can write to. It must be visible, and the line must be the element's only text:
The code works once and expires in 7 days. Keep it there while you use Pro or the Seal: we check it again before each report and before issuing or renewing the Seal. We look for it only in the homepage HTML as your server first sends it (what “View page source” shows), so text that JavaScript adds later doesn't count. Apps that build the whole page with JavaScript, such as most Base44 apps, should use Option B instead. On Base44: on paid plans, paste the Option B meta tag inside the <head> of index.html (Dashboard → Code) and publish; on the free plan, ask the Base44 AI chat to add exactly that meta tag to the <head> of index.html and publish. After publishing, click Verify. - Option D: an email to your own domain — we send a one-time link, valid for 72 hours, to a standard address on your site's domain. Open it, press Confirm, then come back to this tab. This only unlocks the check in this tab: Pro and the Seal need Option A, B or C.
- Option D: an email to your own domain — not available for shared platform subdomains (such as *.base44.app or *.vercel.app). Use Option A, B or C. On Base44: on paid plans, paste the Option B meta tag inside the <head> of index.html (Dashboard → Code) and publish; on the free plan, ask the Base44 AI chat to add exactly that meta tag to the <head> of index.html and publish. After publishing, click Verify.
Already have an older Vigia token in that file or tag? Keep it (Pro uses it for the weekly check) and add this one on a new line or a second tag.
Privacy note
If you sign up for updates, we store your email, the plan you were interested in (free, Pro or Agency) and when you signed up, so we can send you the Vigia emails you agreed to. We do not sell your data and we use no tracking cookies. You can ask us to delete your email anytime by replying to any message or writing to customerservice@tryvigia.com. Full details: Privacy Policy.
FAQ
Does Vigia guarantee my app is secure?
No. Vigia is an automated check of the most common mistakes in AI-built apps. It is not a penetration test or a security audit, and a clean report does not mean your app has no vulnerabilities. Think of it as a smoke alarm, not a fire inspection.
Can I scan someone else's site?
Only a limited summary check. For the full check you must own the app or have written permission from its owner. In the summary check we read just the homepage and up to 6 JavaScript files it loads, and say only whether we found something that needs attention, never what or where. To see the details, and before we check anything else, you prove the site is yours with a code we give you: a small file at /.well-known/vigia-verify.txt, a meta tag inside the <head> of your homepage, or a line of visible text on your homepage (for builders that let you add an HTML block but not files). Apps built with JavaScript, such as Base44 apps, need the meta tag: on Base44's paid plans, paste the meta tag inside the <head> of index.html (Dashboard → Code) and publish; on the free plan, ask the Base44 AI chat to add exactly that meta tag to the <head> of index.html and publish. After publishing, click Verify. If the site is on its own domain, you can also confirm with a link we email to a standard address there, such as admin@ (this unlocks the check only, not Pro or the Seal). Site owners can ask us to exclude their domain from summary checks. Deeper tests on verified sites (like reading your Supabase tables) are coming soon.
Do you need access to my code?
No. The free check only looks at what your site already serves to every visitor.
Do you store what you find?
No for the free check: the report is generated, shown to you and not saved on our side. With Pro, we keep the results of each weekly check for each monitored site (what we found, where, and when), so we can tell you what's new or fixed and email you the report. Keys always appear masked (at most the first and last 4 characters), never in full. To prove ownership, we keep the site address, how it was proved, its verification code and when it was verified. For the summary check we keep the domain, the time and the result shown (found or not found) for 30 days, and a scrambled form of your IP for 7 days, to prevent abuse, never the page content or any key. Details and how long we keep it: privacy policy.
How do I pay, and can I cancel?
You pay by card in the checkout of Paddle, our reseller (Merchant of Record), which handles the invoice and VAT. Cancel anytime: Pro stays active until the end of the period already paid. Full refund of any payment within 14 days: see the refund policy.