What this is and how it works

Why it exists

AI tools can build a working app in an afternoon. What they often skip are the things you can't see by using the app: a secret key left in the code your site sends to every visitor, a settings file that anyone can download, or the standard safety instructions a site is supposed to give browsers. The app works fine, so nobody notices. Bots that scan the internet for exactly these mistakes do.

This check looks at your site the way one of those bots would, then tells you what it found in words you don't need a security background to follow. Every report includes a message you can paste into your AI tool so it can make the fixes for you.

What we check

• Secret keys in your site's code. Keys for services like Stripe, OpenAI, Anthropic, AWS, GitHub, Slack, SendGrid and Supabase that should only live on a server, plus private keys.
• Files that should never be public. .env files, the .git folder and config files that hold passwords.
• Browser safety settings. Whether your site tells browsers to always use a secure connection, to block other sites from loading it in a hidden frame, and to limit which scripts can run. Developers know these as security headers.
• Cookies and access from other sites. Whether login cookies have their locks switched on, whether other websites can read a logged-in visitor's data, whether http sends people to https, and whether your server announces its exact software version.

Each problem has its own page explaining what it means and how to fix it on common hosts.

How the checker behaves

It's built to be safe to run on a live site. These are the exact rules it follows.

• Read only. Only GET and HEAD requests. No form submissions, no logins, no attack payloads, no guessing of passwords or paths beyond a short fixed list of well-known files.
• Small and fixed. At most 30 requests per check, no more than two at a time, every response capped in size, and the whole check stops after 20 seconds.
• Rate limited per site. A site gets at most one fresh check per minute and a small number per hour, however many people submit it. Everyone else sees the recent result.
• Public addresses only. We resolve the address first and refuse private networks, localhost and cloud metadata addresses, including after redirects.
• Identifiable. Every request sends this user agent: PwnMyVibeCode-Checker/1.0 (+https://pwnmyvibecode.com/about)

If you saw our checker in your logs

Someone asked us to check your site. The requests above are all it did. If you want us to stop checking a domain you own, email hello@pwnmyvibecode.com from an address at that domain and we'll add it to a block list. A block covers every subdomain too.

What a grade means

Your site gets a letter from A to F, based on what we could see from the outside at that moment. Anything that belongs in Fix now pulls the grade down hard: one of the most serious problems means an F, whatever else is right.

An outside check can't see everything. Who can read what in your database, how your login works and what your server code does all need a look from the inside. So an A means the outside of your site is in good shape, not that the whole app is secure. Every report lists what it couldn't check.