Skip to content
Vibe-Rater
Check a site

Baseline checks for AI-built apps

Good vibes. Fewer nasty surprises.

AI coding tools ship the app before anyone sets the dull options. Check headers, HTTPS, cookies, and email from the outside — then take a private scorecard back to your editor.

Aimed at people shipping with Lovable, Bolt, v0, Replit, Cursor and similar — often on Vercel, Netlify or Cloudflare, with Supabase or Firebase behind the app.

Example scorecard

example.com

B

78

out of 100

Fair

Web72%
  • Content-Security-Policy headerFail
  • X-Content-Type-OptionsIn place
  • DMARC policyWarn

Start a check

Use an email address at the same domain as the site. Outside look only — no login, no changes.

Outside look only · Private until you share · Not a penetration test

What a baseline check looks at

A passive look at the public site and the domain. See every check.

The website

What a visitor’s browser can see before anyone signs in.

  • HTTPS certificate and the redirect from HTTP
  • Old TLS versions
  • Content-Security-Policy and HSTS
  • Cookie flags (values are never shown)

Email and the domain

Whether someone else can pretend to send mail from your domain.

  • SPF, DKIM, and DMARC
  • Lighter mail records (MTA-STS, TLS-RPT, BIMI)
  • Subdomains left pointing at hosting that no longer exists

So the fix fits

We notice the stack from the outside, then write the advice for it.

  • Hosting such as Vercel, Netlify, or Cloudflare
  • Framework clues from public responses
  • Services such as Supabase or Firebase when they are visible

Proving ownership unlocks a closer look — keys left in the page’s JavaScript, exposed files, database rules — which is not part of the check this form starts.

How it works

  1. 01

    Show you belong to the domain

    Enter the site and an email address at the same domain. We send a single-use link. Shared platform addresses such as vercel.app need a different proof of ownership.

  2. 02

    We look from the outside

    Headers, cookies, TLS, and email setup. We do not log in, change anything, or try passwords.

  3. 03

    Take the scorecard back to your editor

    A private grade, plain-English findings, and a fix aimed at the platform you actually use.

For the tool you used

The same checks, with a page for the builder or host you are likely to ask about.

Frequently asked questions

What do I need to start?

An email address at the same domain as the site. Shared hosts such as vercel.app need a different proof of ownership.

What does the grade mean?

A private baseline score from A+ to F for the outside checks on this page. A high grade is not a verdict that the app is secure.

Do you change the site?

No. The check only sends safe reads. It does not log in, try passwords, or use any key it might see.

Is this a penetration test?

No. Every page carries the same statement in the footer: Vibe-Rater is not a penetration test, and a good score does not mean your app is secure.