Small tools that answer one question each.
All free, no account. Some check a URL, others check something you paste.
Security headers checker
Response headersTen response-header checks on any URL, with the exact config to fix each one on Vercel, Netlify, Cloudflare or Next.js.
Checks a URLExposed API key scanner
Keys and secretsReads the script files your page loads and reports the database, payment and model-provider keys that should never have left your server.
Checks a URLCookie security checker
CookiesLists every cookie your site sets and whether each one carries Secure, HttpOnly and SameSite.
Checks a URLCSP validator
Response headersPaste a policy and see what it really permits, including the cases where strict-dynamic or a nonce quietly cancels a directive out.
Runs in your browserSupabase key checker
TokensTells you whether a Supabase key is the anon key or the service_role key that bypasses RLS. Never leaves your browser.
Runs in your browserWhat a free tool can tell you, and where it stops
Each tool above looks at one thing from the outside. It asks your site for a page the same way a visitor's browser does, reads what came back, and reports on one family of checks. That is genuinely useful, because most of these problems are a single missing header or a single flag, and because you can usually fix them in a config file in about a minute. It is also genuinely narrow, and it would be dishonest to pretend otherwise.
What none of these tools can see is your code. They do not know whether the query behind your dashboard checks who is asking. They cannot tell that a dependency you installed last spring has a known hole in it, or that a key was committed six months ago, deleted from the file, and left in the git history where it still works. They never see your deployment settings. Those are the failures that actually take an app down, and none of them shows up at the front door.
So the split is deliberate. Use these when you want one answer fast, or when you are checking that a fix you just deployed really landed. Use the free URL scan when you want everything the outside of your site reveals in one report. Connect a repository when you want the inside too, which is the only view that can tell you whether the app is safe to launch rather than whether its headers are tidy.
Nothing here is a trial, and none of it is limited to encourage an upgrade. Check sites you own or are authorized to test.
These check the front door. VibeZero reads the whole building.
Connect your repository and VibeZero scans the code, the dependencies, the secrets in your git history, the deployment config and the running app together, then gives you one go or no-go decision instead of a pile of separate results. Every finding comes back as a task your AI agent can pick up, and a rescan is what marks it fixed, not your say-so.