Seatbelt
Back to Seatbelt

Audit my vibe-coded app?

Start with a Ship Read on the build you are about to share. Not a pentest or a $3k compliance audit. One plain-English pass on login, money, keys, customer data, databases, and risky shortcuts.

Run a Ship ReadSee a sample report

Reviewed July 2026

The short version

  1. Export or clone the project: GitHub sync, ZIP download, or the folder on your machine. Clone GitHub locally, no git URL paste.
  2. Run /seatbelt in Cursor on that folder or ZIP path, or open /app for fixture demos and a live URL read.
  3. Read the verdict. Cleared means every hard gate is closed. Must-fix items show file, line, and next step.
  4. Forward the report link as proof, or fix and run again until you are cleared to share.

Works on Lovable, Bolt, Cursor, Replit, and anything else that hands you real files. Platform checklists: before you launch and Bolt before Netlify.

  1. 01

    Hand it the build, not just the URL

    URL scanners grade what is already live. That is useful after deploy. The ship moment is before strangers open the link: keys in the JavaScript bundle, service roles in the client, database rules that allow everything.

    What to hand off

    • A project folder on your machine, primary path via /seatbelt in Cursor
    • A local ZIP export from Lovable, Bolt, or Replit, same MCP scan, pass the file path
    • A GitHub repo, clone it locally, then scan the folder (no git URL paste today)

    Honest limit today: the full six-surface read needs the repo artifact through MCP. At /app you get fixture demos and a live URL outside-view read, not folder or ZIP upload. See compare tool lanes.

  2. 02

    Six surfaces that actually hurt vibe-coded apps

    Not CVE hunting or lint theater. The places AI-built apps get embarrassed on day one.

    • Secret keys in the public build
    • Open database rules
    • Login and server auth
    • Payments and checkout wiring
    • Customer data cues
    • Risky admin and debug routes

    What Seatbelt reads: static clues in the files you share. Walk through each surface by hand on the before you launch checklist.

  3. 03

    A report you can forward

    Clients, cofounders, and r/vibecoding threads want proof you did not skip a check. The Ship Read link is the delivery artifact: cleared or not, what is open, what was fixed, honest scope at the bottom.

    What you get back

    • Plain English verdict: cleared to share or not yet
    • File and line for every must-fix item
    • Shareable report link you can send to your agent to review
    • Optional Verified badge embed when hard gates clear

    Sample: open a live Ship Read report to see the card layout before you run your own.

Run your vibe-coded app check now

Full findings included, not a locked score. Run it on a typical side project export.

  • Full read: /seatbelt in Cursor or Claude Code on a folder or local ZIP path
  • Browser tryout at /app: fixture demos and live URL outside-view read
  • Flagged git pushes can park on a pull request instead of main
Try a Ship ReadGet started with /seatbeltCompare tool lanes

Questions

How do I audit my vibe-coded app before launch?

Export or clone to a folder or ZIP on your machine, then run /seatbelt in Cursor or Claude Code. Or try fixture demos and a live URL at /app. You get a plain-English verdict on six surfaces and a shareable report link. It is a pre-ship safety check on the build you hand off, not a full security audit or pentest.

Is this the same as a paid security audit?

No. Paid audits probe live systems and compliance scope over days or weeks. Seatbelt reads the static build and tells you if the scary launch-day mistakes are exposed. Honest scope stays on every report.

Can I check with just my live Netlify or Vercel URL?

Not yet for the full six-surface read. At /app you can paste a live URL for an outside-view read, what visitors can already see on the wire. The full repo read needs a folder or local ZIP through /seatbelt in Cursor. See compare for the lane map.

Why not just ask ChatGPT if my app is safe?

Your agent summarizes what it thinks it built. Seatbelt reads the actual files independently and returns a shareable report with file and line.

Does Bolt or Lovable already scan for me?

Platform scans are real and they live inside the builder. Seatbelt is the cross-platform check at ship time: after export, after Cursor edits, with a report link you can forward. Bolt builders: read the Bolt checklist. Lovable: clone the GitHub repo and scan that folder.

Building with agents?

Install once on Get started, then say /seatbelt before you share the link. Optional push gate parks flagged deploys on a pull request while hard gates are open.