About VibeShieldsScanner

You saw VibeShieldsScanner in your logs

VibeShields checks apps for open databases and leaked keys, but only apps whose owners have proven they own them and given written permission. Our requests identify themselves with this User-Agent:

VibeShieldsScanner/1.0 (+https://vibeshields.com/scanner)

What the checks do

• Load the pages and JavaScript files your visitors already receive, and look for keys that should be private.
• Ask the app's own Supabase or Firebase project, only if the owner has marked it, whether tables can be read without signing in. We read at most a tiny sample to confirm, and never store the values.
• Send GET requests only, with timeouts, a cap per check and automatic back-off. Never forms, sign-ins, writes or deletes.
• Stay on the verified domain and the databases it uses. We never follow links to other sites.

What the checks do not do

• No password guessing, no attacks, no load testing.
• It is not a penetration test, audit or certification, and it can miss problems.

Didn't ask for this?

If you own a site and believe we checked it without your permission, email abuse@vibeshields.com with the domain and the time you saw our requests. We will stop and look into it within one business day. Proof of ownership is re-checked before every scan, so removing the VibeShields DNS record or file from your site also stops checks.