Security scanner for leaky vibe-coded apps

What to build

A read-only security scanner web app for AI-generated/vibe-coded apps: users paste a URL, it checks for exposed .env/.git files, leaked API keys in client bundles, open Supabase tables via anon key, missing security headers, and expiring SSL certs. Free scan gated behind email capture, paid tier unlocks a detailed PDF report and continuous monitoring.

Vibe-coded apps built fast with AI assistants routinely ship with exposed secrets and open database tables, creating demand for a narrow, purpose-built scanner that speaks directly to indie builders rather than enterprise DevSecOps teams.

Demand

Indie developers, agencies, and no-code builders who ship AI-generated apps without a security review step are the target buyers, and the trend of fast AI-assisted shipping is actively increasing this exposure right now.

• r/SideProjectNews

  Builder self-promo thread for LeakWatch, a read-only check for leaked keys and open Supabase tables in AI-built apps, posted to r/SideProject.

Stack

• Next.js
• Supabase
• Node.js HTTP/TLS libraries for header and cert checks
• Resend or Postmark for email-gate delivery
• Stripe for paid report unlock
• Playwright for crawling client-side bundles

Solo + AI difficulty

The core checks (fetching headers, probing .env/.git paths, hitting Supabase REST endpoints with anon keys, parsing cert expiry) are straightforward with AI help and doable in days. Harder parts are tuning detection to avoid false positives/legal gray areas on scanning third-party domains and building a trustworthy report UI; MVP in 1-2 weeks, paid tier polish longer.

Entry threshold

Low barrier: the checks are all passive GET requests against public URLs, no exploitation or auth needed, so a solo developer can build and ship this in days to a few weeks. The harder part is building trust (scanning someone's site requires their permission) and converting free users into paid report buyers.

Window

6-12 months

Where to find first users

• r/SideProject
• r/vibecoding
• Indie Hackers
• Product Hunt launch
• Twitter/X AI-builder community

Competitors

• GitGuardian
• truffleHog

Counter-signals & risks

• Existing general-purpose security scanners (GitGuardian, truffleHog, Nuclei, Shodan) and Supabase's own built-in security advisor already cover much of this surface, leaving thin differentiation for a narrowly-scoped new entrant.

• Hobbyist and indie developers who make up much of the target audience tend to have low willingness to pay, which can undercut freemium-to-paid conversion economics.

• Supabase or similar platform vendors could ship native security scanning or alerting, commoditizing the core value proposition quickly.