About the checker, and how it behaves

Why this exists

AI tools can build a working app in an afternoon. What they often skip are the things you can't see by using the app: a secret key left in the code your site sends to every visitor, a settings file that anyone can download, or the standard safety instructions a site is supposed to give browsers. The app works fine, so nobody notices. Bots that scan the internet for exactly these mistakes do.

This check looks at your site the way one of those bots would, then tells you what it found in words you don't need a security background to follow. Every report includes a message you can paste into your AI tool so it can make the fixes for you.

What it checks

The quick check covers browser safety settings, cookies and https. The full check adds the rest below once your site carries your tag: one line in your home page, or a DNS record. The tag is made from a key saved in your browser.

• Secret keys in your site's code. Keys that should only live on a server: Stripe, Clerk, OpenAI, Anthropic, Gemini, OpenRouter, Groq, xAI, Hugging Face, Replicate, AWS, GitHub, Slack, SendGrid, Resend and Supabase, plus private keys.
• Your database's front door. If your app talks to Supabase or Firebase straight from the browser, your access rules are the only lock. The check can't see those rules from outside and never touches your data, so the report says so and shows you how to check them yourself in a couple of minutes.
• Files that should never be public. .env files, the .git folder and config files that hold passwords.
• Browser safety settings. Whether your site tells browsers to always use a secure connection, to block other sites from loading it in a hidden frame, and to limit which scripts can run. Developers know these as security headers.
• Cookies and access from other sites. Whether login cookies have their locks switched on, whether other websites can read a logged-in visitor's data, whether http sends people to https, and whether your server announces its exact software version.

Each problem has its own page explaining what it means and how to fix it on common hosts.

How the checker behaves

It's built to be safe to run on a live site. These are the exact rules it follows.

• Read only. Only GET and HEAD requests. No form submissions, no logins, no attack payloads, no guessing of passwords or paths beyond a short fixed list of well-known files.
• Quick unless tagged. A quick check only loads the page you entered and tries it over plain http. The file, key, database, CORS and server version checks run only when the site's home page carries the tag, or its DNS has the TXT record, for the key held by the browser that asked.
• Small and fixed. At most 30 requests per check, no more than two at a time, every response capped in size, and the whole check stops after 20 seconds.
• Rate limited per site. A site gets at most one fresh check per minute and a small number per hour, however many people submit it. Everyone else sees the recent result.
• Public addresses only. The checker resolves the address first and refuses private networks, localhost and cloud metadata addresses, including after redirects.
• Identifiable. Every request sends this user agent: PwnMyVibeCode-Checker/1.0 (+https://pwnmyvibecode.com/about)

If you saw the checker in your logs

Someone ran a check on your site. The requests above are all it did. Unless your site carries a tag you added, that was only the quick check. To stop checks on a domain you own, email hello@pwnmyvibecode.com from an address at that domain and it goes on a block list. A block covers every subdomain too.

What a grade means

Your site gets a letter from A to F, based on what the check could see from the outside at that moment. Anything that belongs in Fix now pulls the grade down hard: one of the most serious problems means an F, whatever else is right.

An outside check can't see everything. Who can read what in your database, how your login works and what your server code does all need a look from the inside. So an A means the outside of your site is in good shape, not that the whole app is secure. Every report lists what it couldn't check.