Your AI built the app. We keep it alive.

VibeCPR is a rescue service for apps built with AI tools like Lovable, Bolt, v0, Replit, Cursor and Claude Code. AI agents scan your code and live app for leaked API keys, open Supabase tables, broken builds and common bugs; a human verifies every critical finding; and you get a ranked report with copy-paste fix prompts within 24 hours.

The Vibe Check is free. A full Rescue Report is $149 ($99 for our first 10 founders) and is credited toward a Fix Pack. A Fix Pack, where we fix up to 3 critical or high issues as pull requests, is $499. Larger Rescue Sprints start at $1,500 and are quoted before work begins.

Yes, the Supabase anon (publishable) key is designed to be public, but only if every table has Row Level Security enabled with correct policies. If a table has RLS off, or a policy like USING (true), anyone with the anon key can read or change that table. The service_role or secret key must never be in frontend code.

CVE-2025-48757 describes Lovable-generated apps whose Supabase tables had missing or insufficient Row Level Security, letting unauthenticated visitors read or write data using the public anon key. The researcher's scan found 170 of 1,645 Lovable projects (about 10.3%) affected. According to the NVD entry, the supplier disputes the CVE.

Since Supabase's Data API grant change, new tables in the public schema are not exposed to the Data API automatically: it became the default for new projects on May 30, 2026 and applies to all existing projects on October 30, 2026. Add an explicit GRANT for the roles that need access, enable Row Level Security, and add policies. Existing tables keep their current grants.

No. The free Vibe Check is passive: it loads your public page like a normal visitor, reads the JavaScript files every visitor already downloads, and checks response headers. It never logs in, submits forms, or writes data. You must confirm you own the app (or have permission) before scanning.

No. We never ask for production secrets, service_role keys or database passwords. For a Rescue Report we use read-only access to one repository (or a zip) and a schema export with no user data. Fixes are delivered as pull requests you review and merge yourself.

Apps built with Lovable, Bolt.new, v0, Replit, Cursor, Claude Code, Base44 and similar tools, typically React, Next.js or Vite frontends on Supabase, with Stripe and Vercel or Netlify hosting.

No. A Rescue Report is a point-in-time, automated review with human sign-off. It catches the most common, most damaging mistakes in AI-built apps, but it cannot prove the absence of vulnerabilities and is not a certification.

Rotate (revoke and replace) the key in the provider's dashboard immediately, before cleaning up code: deleting it from your repo does not stop someone who already copied it. Then move the call to server-side code, store the new key in a server-only environment variable, set spending limits, and remove the old key from git history.