You shipped fast with AI. Vigil finds the leaked keys, open databases, vulnerable dependencies and security holes it left behind, then hands you the exact fix. Then it keeps watching.
Catches the mistakes made by every AI builder
AI-built apps ship with a secret key exposed in the browser.
of Supabase apps we scan have at least one table open to the public.
Every finding comes with the evidence, a one-line command to reproduce it, and an effort estimate. Not an opinion.
Security first, because that's what gets AI-built apps breached. Then everything a great launch needs.
A passive scan reads what's public. Once you verify you own a domain, the way you verify a site with Google, Vigil runs authorized active tests: SQL-injection and XSS probes, open redirects, CSRF, HTTP methods and rate-limiting checks. Every probe is non-destructive and nothing but detection, so it's safe to run on production and you stay in the clear.
Verify in one minute with a DNS record, a file upload or a meta tag.
No install, no signup. Vigil reads your live site like an attacker would, or your repository like a reviewer would.
A score out of 100 and every finding ordered by how badly it could hurt you, each explained in plain English.
Copy the Fix Pack into Cursor, Claude Code or Lovable. Apply, re-scan, and turn on monitoring so it stays fixed.
Everyone gets their score and top fixes free. Upgrade for every fix, the Fix Pack, monitoring and alerts.
See exactly where you stand.
For agencies and teams shipping many apps.
Prices in USD. Cancel anytime. 7-day money-back guarantee on paid plans.
No. Vigil scans your live, public website from the outside, exactly like an attacker or a search engine would. For code, dependency and secret checks you can also point it at a GitHub repository; public repos work instantly, private ones with a read-only token.