# VibeAlarm

> A smoke alarm for your AI-built app.

VibeAlarm watches apps built with Lovable, Bolt, Replit, Cursor, and v0. It catches quiet breakages and exposed data, then hands you a fix prompt you can paste back into the builder.

## Who it is for

VibeAlarm is for people shipping an app they built with Lovable, Bolt, Replit, Cursor, and v0, including founders who are not writing these checks by hand. It does not ask for your source code or a login to the builder. You submit a public URL for an app you own or are allowed to test.

## What the free check does

The free check needs no account. It reads the public site only. It does not submit forms, does not sign in, and does not run signup, login, or checkout.

It looks at:

- Whether the homepage responds
- TLS, meaning the HTTPS certificate
- Security headers: Strict-Transport-Security, framing, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy, and Permissions-Policy
- Known secret shapes in the public JavaScript, such as a Stripe secret, AWS key, GitHub token, Slack token, OpenAI key, Resend key, or private key. A publishable Stripe key or a Supabase anon key is not, by itself, treated as a leak.
- A read-only check when a Supabase or Firebase config is public. Supabase: one row from each table the anon key can list. Firebase: a shallow Realtime Database read, and a one-document read of the collections users, profiles, and accounts. It does not write.
- robots.txt and sitemap.xml

Each finding includes a fix prompt for the builder you picked, so you can paste it back into that builder.

## How paid monitoring works

Monitoring starts after you sign in and pick a plan. You prove the domain with a DNS TXT record, a meta tag, or a file on the site. Scheduled checks run only after that proof passes. VibeAlarm will not drive a browser at the site until then. Run now in the dashboard can still read the public site before verification.

Both paid plans re-run the public checks once a day. The schedule waits about 24 hours between runs. You can also press Run now in the dashboard.

After the domain is verified, a paid plan can play back a flow you record: visit, fill, click, and expect text, using a test login. The test password is encrypted before it is stored, and the browser stays on that hostname. Signup, login, and checkout are checked only if you recorded those steps.

The first run emails a baseline. Later runs email when a warning or critical check goes from passing, or from unseen, to failing. The email includes the fix prompt. When a recorded step failed, the email can include a screenshot. Both plans do this. While alerts are on, paid plans also get a weekly summary of open issues.

Watch adds a weekly pass that reads more of the public JavaScript for leaked keys. That pass does not replay the recorded flow.

Cancel anytime in the Stripe customer portal. Cancellation stops the next renewal. A partial month is refunded only when the law requires it.

## Pricing

- Free public check: $0. No account. Public pages only.
- Monitor: $19 per month. One app, checked every day. Passive scan plus the flows you record.
- Watch: $49 per month. Five apps, checked every day, plus a weekly pass for leaked keys.

Stripe bills each paid plan monthly, in USD. This app does not collect tax.

## Links

- [Home](https://vibealarm.app/): what VibeAlarm is, and the free check
- [Pricing](https://vibealarm.app/#pricing): Monitor and Watch
- [Privacy](https://vibealarm.app/privacy): what is stored
- [Terms](https://vibealarm.app/terms): plans, cancellation, and limits
- [Contact](mailto:support@vibealarm.app): support@vibealarm.app