No black box. Here's exactly what a SafeLaunch scan checks, how we verify an app's agent endpoint, how the trust signal itself is cryptographically signed — and, just as important, what we deliberately don't claim.
Hard-coded keys by signature — Stripe (sk_live), OpenAI, Anthropic, GitHub, Google, Slack, and Supabase service-role keys (decoded to confirm the role). The #1 way a vibe-coded app leaks access. Secrets are redacted, never echoed in full.
A secret shipped to the client — a NEXT_PUBLIC_ variable holding a secret, or a browser component referencing the service-role key. The classic “token sent to the frontend” mistake.
A real .env committed to the repository (visible in history even after deletion), or a missing .gitignore that would let one slip in.
Whether each database table has Row-Level Security enabled — so the app's data and API aren't left wide open to anyone with the public key.
On the deployed site: security headers, and whether secret files are publicly downloadable over HTTP. A passive, read-only check — the same request a browser makes.
Known-vulnerable packages (via OSV), and hidden or obfuscated code using malware techniques (eval, remote loading, off-screen payloads).
When an app declares an agent endpoint — a REST API, an MCP server, or an A2A agent card — we verify the basics another agent would care about before it connects:
The endpoint is served over HTTPS and actually responds. Agents can't trust an unencrypted or dead endpoint.
We run the same secret detection on the endpoint's public response — a surprising number leak a key in their own manifest.
For MCP servers and agent cards, the manifest is well-formed and declares what it claims to (tools, capabilities, schema).
It's the same GET any client would make — not a full penetration test, and nothing is sent that could change the app's state.
Every trust record is an EdDSA-signed attestation. An agent verifies it against our published JWKS (/.well-known/jwks.json) to confirm it genuinely came from Viberrr and wasn't tampered with.
Tokens are short-lived — re-fetch for a current one. The record carries the real last-checked date and re-check cadence separately, so “currently valid token” is never confused with “recently scanned.”
Source is analysed in memory and discarded — only the result is retained. Deeper, behind-login review runs over a read-only connection, with the builder's consent.
A passing scan means a defined set of automated checks passed. It is a signal, not a guarantee, and it is not active protection. We do not test runtime authorization depth (e.g. broken access control or IDOR behind a login), payment-flow correctness, or application business logic in the standard scan. Those deeper, behind-login checks are the owner-consented Deep Scan. Being explicit about the edge of what we checked is the whole point — an over-claimed signal is worthless to the people and agents who rely on it.
Our checks map to public standards — OWASP, CWE and OSV — so what “passed” means is inspectable, not proprietary.
The scan detects hard-coded keys and tokens by signature — Stripe, OpenAI, Anthropic, GitHub, Google, Slack and Supabase service-role keys — anywhere in the code, and flags any secret that's been shipped to the browser, committed in a .env file, or left downloadable on the live site. Hard-coded credentials are the single most common way a vibe-coded app leaks access, so that's the core of the check. Secrets are redacted in the report and never echoed back in full.
When an app declares an agent endpoint, we passively verify the basics another agent would care about before it connects: it's served over HTTPS, it's reachable, its public response or manifest doesn't leak a secret, and (for MCP servers and agent cards) the manifest is actually valid. It's the same read-only GET any client would make — not a full penetration test.
Every Viberrr trust record is a cryptographically signed attestation (EdDSA) that any agent can verify against our published JWKS at /.well-known/jwks.json — so a consumer can confirm the record genuinely came from Viberrr and wasn't tampered with. The tokens are short-lived (re-fetch for a fresh one), and the record carries the real last-checked date and re-check cadence separately from the token's validity window.
No. Code is analysed in memory and discarded — only the result is retained. Public-surface checks need no special access; the deeper, behind-login review runs over a read-only connection with the builder's explicit consent.
No, and we never say it is. SafeLaunch is an automated scan that surfaces the common, serious issues, plus optional continuous monitoring. It is an honest signal that a defined set of checks passed — not a warranty, and not active protection. We're explicit about that everywhere, because an over-claimed signal is worth nothing to the people and agents who rely on it.
Scan your app and get the full report — every finding in plain English, with the exact prompt to fix it.