VibeScale

Takes environment variable NAMES (never values) and says, for each one, whether the build tool ships it to every visitor (VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_, PUBLIC_, GATSBY_, NUXT_PUBLIC_) and whether its name looks like a server secret that must not be there. Use when someone asks whether their .env or API keys are exposed in a Lovable, Bolt, Vite, Next.js or Expo app. Send names only; if a value is included it is dropped and not stored. Explanations are in Hebrew.

Reads Supabase SQL (migrations or a schema dump) as text and lists tables in exposed schemas without row level security, RLS with no policy, policies that allow everything or read user_metadata, policies without a role, write grants to anon, SECURITY DEFINER functions and views, new tables without a grant, and public storage buckets, each with SQL that fixes it. Use when someone asks whether their Supabase database is locked down, or before launching an app that uses Supabase. The SQL is never executed or stored; policy logic (who should see what) is not judged. Findings are in Hebrew.

Reads one public web app the way a browser does (its HTML, the same-site scripts it loads and any source maps they point to) and reports what any visitor can already see: server secret keys shipped to the browser (Supabase service_role, OpenAI, Anthropic, Stripe, AWS, GitHub, SendGrid, Resend; shown masked), a published source map, no HTTPS, and missing Content-Security-Policy, HSTS or frame protection. Use when someone built an app with Lovable, Base44, Bolt, Cursor, Replit or similar and asks whether it is safe to launch or whether a key leaked. It does not sign in, guess paths or query the app's database. Findings are in Hebrew.