Example

TaskNest

This is a sample report for a fake todo app. Nothing here belongs to a customer, and every key in the app is made up. When checks are open, add https://demo.vibevet.app/ and run it yourself.

Grade

9 / 100

We found 4 issues. 3 should be fixed first. Start with: A secret key is sitting in your website's code.

A clean result does not mean the app is 100% safe. This is not a full audit.

Checked November 3, 2026 at 4:00 PM UTC

What this check tested

The public page, the scripts it loads, a few common files, response headers, and any database or file address left in that public code.

What this check did not test

Checks do not log in as a user. They only see what an outsider can reach. They do not open private dashboards, paid areas, or anything behind a login.

A clean result does not mean the app is 100% safe.

Fix this first

A secret key is sitting in your website's code

What this is

The JavaScript TaskNest sends to the browser includes a Stripe secret key. The value is fake and was put there on purpose.

Why it matters

On a real app, anyone can open that script, copy the key, and use it as you. A publishable key is fine in the browser. This shape of key is not.

Evidence

Request: GET https://demo.vibevet.app/app.js
Came back: HTTP 200. The script includes Stripe secret key: sk_liv_XXXX.

Fix prompt

Paste into any AI builder.

You are fixing a security issue in this app. Keep the change small. This prompt works in Lovable, Bolt, Replit, v0, Cursor, or any other AI builder.

A secret key was found in client-side JavaScript. Remove every secret from frontend code.
Move that work to a server-only route. Store the secret in an environment variable that the browser cannot see.
The browser may keep a publishable Stripe key. It must not keep a secret key.
Tell me to rotate the leaked key in the provider dashboard. Do not invent a new secret in the code.

Do not print secret values, tokens, or passwords in the chat or in the code.
When you are done, tell me which files you changed, in plain language.

Fix this first

Your database answers without a login

What this is

TaskNest exposes a public anon key and a read endpoint. A one-row read succeeded without a user session.

Why it matters

On a real app, anyone who views the page source can copy the public key and read those tables. That often includes names, emails, or tasks. This sample did not change any data.

Evidence

Request: GET https://demo.vibevet.app/rest/v1/tasks?select=*&limit=1
Came back: HTTP 200. Table tasks answered a 1-row read using only the public anon key. Column names: id. Row values were not saved.

Fix prompt

Paste into any AI builder.

You are fixing a security issue in this app. Keep the change small. This prompt works in Lovable, Bolt, Replit, v0, Cursor, or any other AI builder.

Turn on Row Level Security for every table that holds private rows.
The public key should not be able to read private tables when nobody is logged in.
After the change, a request with the public key and no user session should return an empty result or a permission error.

Do not print secret values, tokens, or passwords in the chat or in the code.
When you are done, tell me which files you changed, in plain language.

Fix this first

Your .env file is on the public internet

What this is

A file at /.env is public and looks like an environment file. The password in it is not real.

Why it matters

Anyone can download it. Real env files hold database passwords and API keys. Values from the file were not saved in this report.

Evidence

Request: GET https://demo.vibevet.app/.env
Came back: HTTP 200. It looks like an environment file. Key names: APP_NAME, DATABASE_URL. Values were not saved.

Fix prompt

Paste into any AI builder.

You are fixing a security issue in this app. Keep the change small. This prompt works in Lovable, Bolt, Replit, v0, Cursor, or any other AI builder.

Stop publishing .env. Store those values only on the server.
Make sure the host does not serve dotfiles.
Rotate every secret that was in the public file, because it should be treated as copied.

Do not print secret values, tokens, or passwords in the chat or in the code.
When you are done, tell me which files you changed, in plain language.

Worth fixing

The browser is missing a few safety headers

What this is

The homepage response does not set Content-Security-Policy, clickjacking protection, or the other common browser headers.

Why it matters

Those headers tell the browser what scripts and frames are allowed. Missing ones make a later mistake easier to exploit.

Evidence

Request: GET https://demo.vibevet.app/
Came back: HTTP 200. Missing: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

Fix prompt

Paste into any AI builder.

You are fixing a security issue in this app. Keep the change small. This prompt works in Lovable, Bolt, Replit, v0, Cursor, or any other AI builder.

Add Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy on every HTML response.
On HTTPS also add Strict-Transport-Security.

Do not print secret values, tokens, or passwords in the chat or in the code.
When you are done, tell me which files you changed, in plain language.

Back to VibeVet