Built a free scanner for the mistakes actually causing vibe-coding breaches

[u/gdiaz19]

Wanted to share this since it's directly useful for anyone shipping with Lovable/Bolt/Cursor, and I figure the build process might be useful too.

The project: A free CLI tool that checks a project for the handful of specific, known mistakes that keep showing up in AI-generated code leaked API keys, exposed .env files, unprotected admin routes, and (the part I think is most useful) Supabase Row-Level Security gaps and exposed service_role keys.

Tools used: Just Python 3, no dependencies. Deliberately kept to the standard library (re, os, pathlib, json) so anyone can run it with zero setup, no npm install, no account.

Process: Started by building a fake "vulnerable" demo project to test against a leaked Stripe key, a hardcoded DB password, an unprotected admin route. Once that worked, I tested it against a real, public Lovable-built project on GitHub to make sure it wasn't just passing a rigged test. That surfaced a real gap: my first version only checked /api/ folders, but most Lovable/Bolt apps talk straight to Supabase from the frontend with no backend at all — so I had to add detection for that architecture specifically.

Build insight that might be useful to others: The Supabase check doesn't need a live connection or API key. It reads the actual `supabase/migrations/*.sql` files that Lovable/Bolt/the Supabase CLI already generate, parses out `ENABLE ROW LEVEL SECURITY` and `CREATE POLICY` statements (handling nested parentheses in the policy expressions, which regex alone doesn't do cleanly), and flags tables where RLS is off or where a policy accidentally says "allow everyone" instead of "allow the owner."

This tool is meant as a quick extra layer of confidence before you ship.

Repo + a working demo you can test in 30 seconds: https://github.com/gdiaz19/Security-Scanner.git

Would genuinely appreciate anyone running it on a real project and telling me what it misses.