VibeCheck
Log inCreate accountSign up
What we check

33 checks, all passive, in 8 categories.

VibeCheck loads your site a few times the way a browser would, then reads what came back. Nothing is posted, injected or guessed.

Scan a site

Passive only

Ordinary requests a browser would make. We never query your database or guess paths.

Quiet when unsure

If the site doesn't answer or shows a bot-block page, you get no grade, not a guess.

One finding per check

Ten bad cookies count once. The score reflects problems, not item counts.

Nothing leaked

Keys are masked and cookie values are never stored.

Browse by category

Transport

Strict-Transport-Security (HSTS) header
Whether the site tells browsers to always use HTTPS, and for long enough.
HSTS
MediumLow
HTTPS certificate is expiring soon
How close the certificate is to expiring, allowing for auto-renewed short-lived ones.
TLS-CERT-EXPIRING
HighMedium
HTTPS certificate is not trusted
Whether browsers would trust the certificate: not self-signed, expired or issued for another name.
TLS-CERT-INVALID
Critical
Site is not available over HTTPS
Whether the site can be reached over HTTPS at all.
TLS-NO-HTTPS
High
HTTP does not redirect to HTTPS
Whether the plain http:// address sends visitors on to https://.
TLS-NO-REDIRECT
Medium
Outdated TLS version
Whether the server negotiates TLS 1.1 or older.
TLS-OLD-VERSION
High

Headers

Page can be loaded inside another site's frame
Whether other sites can embed the page to trick visitors into clicking.
CLICKJACK
Medium
Content-Security-Policy header is missing
Whether a policy limits where scripts can load from.
CSP-MISSING
Medium
Content-Security-Policy is too permissive
Whether the policy allows unsafe inline scripts, eval or wildcard sources.
CSP-WEAK
MediumLow
Permissions-Policy header is missing
Whether the site limits browser features such as camera and location. A hardening hint.
PERMISSIONS-POLICY
Info
Referrer-Policy is missing or leaks the full address
Whether the full page address leaks to other sites through links.
REFERRER-POLICY
Low
X-Content-Type-Options: nosniff is missing
Whether browsers are told not to guess file types.
XCTO-MISSING
Low

Cookies

Session cookie readable by JavaScript
Session cookies that scripts on the page can read.
COOKIE-NO-HTTPONLY
MediumLow
Cookie without the Secure flag
Cookies that could travel over an unencrypted connection.
COOKIE-NO-SECURE
MediumLow
Cookie without a safe SameSite setting
Cookies that other sites can send requests with.
COOKIE-SAMESITE
MediumLow

Disclosure

HTML comments reveal sensitive details
Comments that mention credentials or internal addresses.
HTML-COMMENT-SENSITIVE
LowHeuristic
robots.txt points to paths that look like leftovers or secrets
Entries that point at backups, dumps or staging areas. The paths are never requested.
ROBOTS-REVEALS-PATHS
LowHeuristic
Server software and version are disclosed
Headers that reveal the server software and its exact version.
SERVER-VERSION
LowInfo
JavaScript source maps are publicly available
Public source maps that expose your original front-end code.
SOURCEMAP-EXPOSED
Medium
The page shows a database error message
Pages that print a raw database error.
SQL-ERROR-EXPOSED
MediumHeuristic

Secrets

Public API keys found (safe by design, check their restrictions)
Keys that are meant to be public, listed so you can check their restrictions.
KEY-PUBLIC-BY-DESIGN
Info
Secret key exposed in front-end code
Private keys and tokens in the page or its scripts: AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, private keys and Supabase service role.
SECRET-DANGEROUS
CriticalHighMedium

Libraries

JavaScript library with known vulnerabilities
Front-end libraries whose version has known security advisories. Severity follows the worst advisory.
LIB-VULNERABLE
HighMediumLow

Web

CORS lets other websites read responses
Whether any website can read responses meant for signed-in visitors.
CORS-WILDCARD-CREDS
HighLow
A form that changes data has no CSRF protection
Forms that change data with no anti-forgery token.
CSRF-FORM-UNPROTECTED
LowHeuristic
Page code writes the address bar into the page as HTML
Script code that feeds the address bar straight into the page.
DOM-XSS-SINK
MediumHeuristic
The site answered with an error page
Whether the site returned an error or bot-block page, so page checks were skipped.
ERROR-PAGE
Info
HTTPS page loads content over plain HTTP
Secure pages that still load scripts, styles or images over HTTP.
MIXED-CONTENT
MediumLow
No security.txt file
Whether the site publishes a security contact at /.well-known/security.txt.
SECURITY-TXT-MISSING
Info
Scripts from other websites have no integrity check
Third-party scripts loaded without an integrity hash.
SRI-MISSING
Low
The site's code switches off Angular's protection against XSS
Angular code that turns off its built-in XSS protection.
XSS-SANITIZER-BYPASSED
LowHeuristic

Backend (BaaS)

Site uses Firebase: review Security Rules
We only detect the service. We never query your project.
FIREBASE-DETECTED
Info
Site uses Supabase: review Row Level Security
We only detect the service. We never query your project.
SUPABASE-DETECTED
Info

Heuristic checks look for patterns that usually, but not always, mean a problem. They count for 70% of the points a certain finding would.

How the score works

Start at 100. Each finding takes off its severity points, scaled by how sure we are.

SeverityPoints
Critical40
High20
Medium8
Low3
Info0
ConfidenceCounts for
High100%
Medium70%
Low40%

Grades

A
90+
B
80+
C
65+
D
50+
F
< 50

Any critical finding caps the grade at D, however high the score.

Results are based on passive checks and public signals. They are evidence, not proof.