Deckproof
00 / Free check for vibe-coded sites: Lovable, Bolt, v0, Cursor, Replit

Your vibe-coded site is live. Is it safe, legal, and solid?

You built it without being a developer. In 30 seconds you get a grade, what is wrong in plain words, and the exact text to paste back into your builder to fix it.

PASTE YOUR SITE'S ADDRESS
https://
No signupWe only look, we change nothing
example report / app-redacted.lovable.apphost anonymised
D
58 / 100

A stranger could read your list of users.

4 problems1 critical1 high2 lower
DSecurity55 / 100A-01, T-02
CEU legal information78 / 100DE-IMP-01
BQuality88 / 100Q-09, Q-06
FIRST FIX / A-01 CRITICALLock the profiles table in Supabase. We give you the text to paste into Lovable, then re-check.
EXAMPLE

One open critical never scores above D.

If a stranger can read your users' data, nothing else matters yet. A beautiful page does not lift the grade until that door is closed. That is the one rule behind the score.

45
POINTS OFF FOR ONE CRITICAL FINDING1

1 From the published formula below: start at 100 per area, subtract 45 per critical, 22 per high, 9 per medium, 3 per low.

01 / IDLE

Watch it earn its grade.

Every site starts at A+. Each real problem costs points, and one critical problem caps the grade at D. Mark the fixes and watch it climb back. Scroll to run the scan, scroll up to rewind.

A+
100 / 1000 findings

SCROLL TO SCAN

assembling
02 / What it looks at

The checks list, in the open.

51 checks in three areas, written so you do not need a developer to understand them. Below is the part of the list that decides most grades. Every ID here is the same ID you see in your report. See every check.

SECURITY9 of 16 shown
A-01
Anyone can read your database
Your Supabase table answers to anyone who asks, no login needed. That is your users' data, readable by strangers. We ask once, read-only, and report what came back.
CRITICAL
S-01
Your master key is inside the page
The Supabase service key sits in your site's code. Whoever reads it owns your whole database, every lock ignored.
CRITICAL
S-04
Your settings file is downloadable
The .env file, with passwords and keys, is served like any other page.
CRITICAL
S-05
Your code history is public
The .git folder is reachable, so your entire source code, past versions included, can be downloaded.
HIGH
T-02
No Content-Security-Policy
A setting that stops injected scripts. Without it a bad script can run as if it were your page.
MEDIUM
T-03
Your page can be framed
Another site can wrap your login page inside theirs and trick your users into clicking.
MEDIUM
C-02
Other sites can read your logged-in data
A sharing setting (CORS) is wide open, so any website can ask your backend for a visitor's data while they are logged in.
HIGH
S-06
Your source code ships with the site
Source maps let anyone read your code, comments and internal links.
MEDIUM
DE-SEC-01
No padlock
Not served over HTTPS, or the certificate is expired or untrusted. Fix this first, everything else waits.
CRITICAL
EU LEGAL INFORMATION4 of 7 shown
DE-IMP-01
No Impressum found
German law expects a provider page on commercial sites (§5 DDG). We say what we found and link the rule. General information, not legal advice.
HIGH
DE-PRIV-01
No privacy notice found
EU law expects one (Art. 13 GDPR). We look for a linked page under the usual names. General information, not legal advice.
HIGH
DE-CK-02
Trackers run before consent
We open the site fresh, touch nothing, and record whether analytics or pixels fire before the visitor answers the cookie banner (TDDDG §25).
HIGH
DE-3P-01
Fonts loaded from Google
Every visitor's address is sent to Google on each visit; often flagged since a 2022 Munich court ruling. General information.
HIGH
QUALITY2 of 5 shown
Q-09
Google sees an empty page
Your site only appears after code runs in the browser, so search engines and link previews see nothing.
MEDIUM
Q-05a
Missing page title or description
Search results and browser tabs show the bare address instead of your name.
MEDIUM
03 / Poke the findings

Three of the things it catches, live.

Each one is a real check from the list. Nothing here touches a real site; it is a piece of the report, taken apart so you can push on it.

Readable without login

A-01 / DATABASE

Your builder gives your site a database. If a table is not locked, anyone who knows the address can read it, without logging in. This is what that looks like. Hover a key: the crawler shows it, then masks it again.

emailstripe_tokenplan
lena.k@…sk_live_••••••••••••sk_live_9fQ2…Vt7apro
omar.b@…sk_live_••••••••••••sk_live_2aN8…Kd01free
jonas.w@…sk_live_••••••••••••sk_live_7Hc3…Pq9mpro
LOCKED BY ROW LEVEL SECURITY
3 ROWS EXPOSED

Missing security headers

T-01 … T-06 / RESPONSE

Headers are small settings your site sends to every browser. Each one closes a door. Click one to see what it protects you from. Red is missing on this sample site, green is set.

Trackers before consent

DE-CK-03 / TDDDG §25

Your cookie banner asks first, but do the trackers wait for the answer? We open the page fresh, touch nothing, and record what runs before you choose.

Google Analyticsfired at 0.4 s
Meta Pixelfired at 0.6 s
Session cookieconsent-gated

Two trackers already ran before you could decide.

04 / Method

The grade is simple maths, and it is published.

You should be able to check the maths yourself, and you should know exactly what we do not do to your site.

Each area (security, EU legal, quality) starts at100
Per critical finding−45
Per high finding−22
Per medium finding−9
Per low finding−3
Per informational finding0
Composite scoremean of the three areas
With at least one open critical, the composite is capped at58
A+95+
A90
B80
C70
D55
E35
F<35

What we don't test

  • Nothing behind a login. We only see what any stranger sees.
  • We never submit forms, never write data, never upload anything. We only read.
  • No password guessing, no flooding your site with requests.
  • No legal judgement. For EU items we say what we found and link the rule, so you can decide for your case.

Your URL, your call

We use your URL only to run this scan. Fetched pages are discarded after grading; only the findings and the grade are kept for your report. Every request we make is shown in the replay next to your grade.

Keine Rechtsberatung: legal items are general information with sources, never individualised legal advice. Found a hole in Deckproof itself? Tell us.

05 / Pricing

The grade is free. Depth is paid.

Prices in EUR, VAT not charged (Kleinunternehmer, §19 UStG). Cancel monthly plans any time. Checkout is a demo until launch: nothing is charged.

EUR, NO VAT
Free
0
Report
9ONCE
Pro
24/ MONTH
Agency
79/ MONTH
Composite grade and three area grades
yes
yes
yes
yes
Every problem found, sorted by how bad it is
yes
yes
yes
yes
The two most important problems, with fixes
yes
yes
yes
yes
Every fix, written for your builder
no
yes
yes
yes
Text you paste into Lovable, Bolt or Cursor to fix it
no
yes
yes
yes
Proof of what a stranger could see (masked)
no
yes
yes
yes
Re-check after fixing, in 60 seconds
no
yes
yes
yes
Unlimited scans
no
no
yes
yes
Daily re-check with an email if the grade drops
no
no
yes
yes
A grade badge to show on your site
no
no
yes
yes
White-label PDF for clients
no
no
no
yes
Multi-site dashboard, bulk and API
no
no
no
yes