Vibe GreenlightFree Mini-Scan · Sat, 17 Oct 2026 12:37:41 UTC
Launch score
NO-GO
9 critical issue(s) must be fixed before launch — real users or attackers could exploit them on day one.
Target: http://localhost:4173/ · 1 page(s) crawled · scan took 15s
9critical
10high
12medium
16low
Executive summary · rule-based
Not ready to launch.
Vibe Greenlight scored http://localhost:4173/ at 38/100 with a NO-GO verdict (9 critical, 10 high, 12 medium, 16 low). 9 critical issue(s) must be fixed before launch — real users or attackers could exploit them on day one.
Blockers: Environment file publicly downloadable (/.env); OpenAI API key exposed in client code.
Secrets: at least one live credential is shipping to the browser — rotate it before anything else.
Broken flows: 1 issue (links, console errors or failed requests) will hit real users on day one.
Recommended next step: Rotate every exposed secret, enable RLS / fix the data leak, then re-run this scan.
💡 Set OPENAI_API_KEY, ANTHROPIC_API_KEY, or XAI_API_KEY (GROK_API_KEY) in the environment to enable LLM-written summary + vision UX review. Optional: VG_LLM_MODEL to override the default model.
UX review · rule-based
Screenshots of the home page (desktop and mobile) were captured for review.
Tips
Above the fold should answer: what is this, who is it for, and what do I do next — in under 5 seconds.
Make the primary CTA high-contrast and verb-led ("Join the waitlist", not an empty button).
On mobile, keep tap targets ≥ 44px and avoid horizontal overflow.
Lighthouse (mobile)
Performance
Accessibility
Best practices
SEO
first contentful paint: 0.9 s · largest contentful paint: 38.3 s · total blocking time: 0 ms · cumulative layout shift: 0.091 · speed index: 2.4 s
GET http://localhost:4173/.env → 200, 241 bytes, defines: DATABASE_URL, STRIPE_SECRET_KEY, OPENAI_API_KEY
How to fix
Your .env file is publicly downloadable. Delete it from the deployed/public folder, rotate EVERY secret in it, and make sure the build only outputs compiled assets.
Fix prompt for Cursor / Lovable / Bolt
My .env file is publicly reachable at http://localhost:4173/.env. Make sure it is never deployed: move it out of the public/static folder, add .env* (except .env.example) to .gitignore and to the deploy ignore list, and configure the server/host to return 404 for any path starting with "/.". List all keys that were in the file so I can rotate them.
CRITICAL
OpenAI API key exposed in client code
VG-002
Anyone who opens your site can copy this key and run up your OpenAI bill or abuse your account.
Evidence
sk-proj-DE…9tY4 found in /assets/index-7f3a9c.js:2, /assets/index-7f3a9c.js.map (sourcesContent):2 — context: …ion(){"use strict"; var OPENAI_API_KEY="
How to fix
Treat this OpenAI key as compromised: revoke/rotate it in the OpenAI dashboard now, then move every call that needs it to a server-side function (API route, Supabase Edge Function, serverless function) that reads the key from a server-only environment variable. Also set a usage limit on the OpenAI account.
Fix prompt for Cursor / Lovable / Bolt
My frontend bundle contains a OpenAI secret (/assets/index-7f3a9c.js:2, /assets/index-7f3a9c.js.map (sourcesContent):2). I have already rotated the key. Refactor the app so the secret is never shipped to the browser:
1. Find every place in the client code that uses this key (search for "sk-proj-").
2. Move that logic into a server-side endpoint (e.g. a Next.js API route / Supabase Edge Function / serverless function) that reads the key from a server-only env var (no NEXT_PUBLIC_ / VITE_ prefix).
3. Make the client call that endpoint instead, and require the user to be authenticated there.
4. Add the env var name to .env.example and make sure .env is in .gitignore.
Show me the diff and list any other secrets you find in client code.
HIGH
2 broken links (pages that error)
VG-013
Evidence
/pricing → 404 (linked from /); /blog/launch-post → 404 (linked from /)
How to fix
A link on your site leads to a page that does not exist. Create the page, fix the URL, or remove the link.
Fix prompt for Cursor / Lovable / Bolt
These links on my site return errors: /pricing, /blog/launch-post. For each one either create the missing page/route (with real content, matching the existing layout), fix the href to point at an existing route, or remove the link from the navigation. Also add a friendly custom 404 page with a link back home.
+ 44 more issues found
7 critical · 9 high · 12 medium · 16 low are hidden in this free mini-scan.
The full Launch Check ($39) includes every finding with copy-paste fix prompts, a real-browser flow test, UX review and a free re-check after you fix.
Automated, outside-in checks: secret scanning of delivered HTML/JS/source maps, exposed-file probes, HTTP security headers & cookies, a headless-browser crawl (broken links, console errors, failed requests), Lighthouse 12.8.2 and SEO/accessibility DOM checks. This is not a penetration test; logged-in flows and data-isolation (RLS/IDOR) are not covered by this report. Secrets are shown masked. Generated by Vibe Greenlight 0.1.0.
