Observed arrival · 2026-10-17
ProdCanary checks whether vibe-coded apps are safe to ship
A security scanner for apps built with tools such as Lovable, Bolt, Cursor, Next.js, Supabase, and Firebase.
- For
- Builders shipping Lovable, Bolt, Cursor, or Supabase apps
- Worth noticing
- Its URL scan makes about three dozen ordinary requests and says it never calls the target’s database or third-party services.
Field notes
The source path accepts a ZIP, local folder, or public GitHub repository; the site says it strips images, videos, node_modules, .git, and lockfiles in the browser before uploading source. It describes the upload as processed in a temporary folder and deleted after the scan, with secrets masked in results. The separate URL check looks at externally visible signals—including headers, cookies, exposed files, HTML, and up to eight of the site’s JavaScript files—and says it makes about three dozen requests.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue