Audit your vibe-coded project
in seconds.

Catch what vibe coding skips: exposed keys, missing RLS, and insecure routes.

First scan free · analyzed for this request only · not stored on our servers

audify — security scanner

Audit Workspace

Paste CodeUpload File
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
import { createClient } from '@supabase/supabase-js';
import { NextResponse } from 'next/server';

// Quick client for the checkout flow — works great locally!
const supabase = createClient(
  'https://xyzcompany.supabase.co',
  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJvbGUiOiJzZXJ2aWNlX3JvbGUifQ.4f9a8b1c2d3e4f5061728394a5b6c7d8e9f0a1b2'
);

export async function POST(req: Request) {
  const body = await req.json();

  const { data, error } = await supabase
    .from('orders')
    .insert({
      user_id: body.userId,
      amount: body.amount,
      card_last4: body.cardLast4,
    });

  if (error) {
    return NextResponse.json({ error: error.message, details: error }, { status: 500 });
  }

  return NextResponse.json({ data });
}

// --- supabase/migrations/0001_init.sql ---
// CREATE TABLE public.profiles (
//   id uuid references auth.users not null primary key,
//   email text,
//   plan text default 'free'
// );
// -- Row Level Security is NOT enabled on this table
Next.js + Supabase
Run Security Audit

First scan is free. Analyzed during your scan and discarded from our servers afterward. · How we handle your code

Built for the stack you ship

Next.js·Supabase·Cursor·Vercel·Stripe

What Audify Detects

Every critical risk, found before launch.

Exposed Secrets & API Keys

Hardcoded OpenAI keys, Supabase Service Role credentials, and JWT secrets left in public client code.

// app/lib/openai.ts
const client = new OpenAI({
apiKey: "sk-proj-a9oDdR…ilW4f3kX"// ⚠ EXPOSED
});

Missing RLS Policies

Unprotected Supabase tables with no Row Level Security — any user can read or write your data.

profiles table — RLS disabled

Insecure API Routes

Missing server-side auth checks, unvalidated input, and unsafe queries in Next.js route handlers.

export async function POST() {
// no auth check ⚠
}

Auto-Fix Snippets & One-Click PDF Export

Every issue comes with a ready-to-paste corrected code snippet. Export the full audit as a branded PDF for your team or clients.

FixSuggested auto-fix
const client = new OpenAI({
apiKey: process.env.OPENAI_API_KEY
});

Security

Your code in. Findings out. Nothing kept on our side.

Security tools only earn trust when they explain what happens to the code. Here’s ours — short and literal.

No server storage

Your code is sent to OpenAI for analysis during the request, then discarded from our servers. We don’t store source in a database.

Not used for training

We don’t use your audits to train models. OpenAI API data isn’t used for training by default under their API terms.

Scoped to the scan

Only the snippet or archive you submit is sent. No repo access, no background crawling, no silent sync.

Transport is HTTPS. Authenticated users are billed through Stripe; we never see your card details. Free scans are rate-limited to keep the service healthy.