Check your app before you launch it
When free scans open, PreFlight will run 65 checks on your app the way any visitor could, then tell you in plain English what to fix first.
What you’ll get
- A Ready or Hold verdict and how many of the 65 checks you pass
- Plain-English findings, not jargon
- 2–3 fixes free with every scan
- A report you can download and keep
No subscription. Pay once per report.
Want to see what a report looks like? Open the sample report (example site, not a real customer).
Works with sites built on
- and more
Not affiliated with or endorsed by these companies. Names are their owners' trademarks.
Three steps. About a minute.
Paste link.
Tick the box to confirm it’s your site, then run the free check.
See what passed.
You see how many of the 65 checks you pass, what’s critical, what’s a warning, and 2–3 fixes free.
Copy the fixes.
Each fix is a prompt you can paste into your AI builder or editor. Verify your site to run the database checks and unlock the rest.
65 checks at launch
How PreFlight compares
One passive scan before launch: 65 checks across security, speed, search, email and accessibility.
Legend: ✓ = offered · ✗ = not listed on the tool's public pages as of 10/19/2026 (for PreFlight: not in our current checks)
| Feature | PreFlight | CheckVibe ↗ checkvibe.dev/pricingchecked 10/19/2026 | Vibe App Scanner ↗ vibeappscanner.com/pricingchecked 10/19/2026 | vibecheck.ac ↗ vibecheck.acchecked 10/19/2026 | getvibecheck.dev ↗ getvibecheck.devchecked 10/19/2026 |
|---|---|---|---|---|---|
| Security: exposed keys and files | Yes | Yes [1] | Yes (keys, source maps) [2] | Yes (keys) [3] | Yes [4] |
| Security: headers | Yes | Yes [1] | Yes [2] | Yes [3] | Yes [4] |
| Security: HTTPS and certificate | Yes | Yes [1] | No [2] | Yes [3] | Yes [4] |
| Speed | Yes (home page) | Yes [1] | No [2] | No [3] | No [4] |
| Search / SEO | Yes | No [1] | No [2] | Yes [3] | No [4] |
| Email and DNS (SPF, DMARC, DKIM) | Yes | Yes (domain/DNS) [1] | Yes (Pro plan) [5] | No [3] | No [4] |
| Accessibility | Yes | Yes (WCAG) [1] | No [2] | No [3] | No [4] |
| Outdated / vulnerable libraries | Yes | Yes [1] | No [2] | No [3] | Yes (repo scan) [4] |
| Privacy / legal pages | Yes | Yes [1] | No [2] | No [3] | No [4] |
| Ownership-verified database checks | Not yet [7] | Owner-connected Supabase [1][8] | No [2][8] | No [3][8] | No [4][8] |
| No account needed to scan | Yes (no email needed; 1 free scan per site) [9] | No [1] | No [2] | Yes (email for results) [3] | Yes [4] |
| What it scans | Live site, from outside (paste one link) | Live site, plus a Supabase project you connect; active tests in beta [1][10] | Live site, including your database, auth and APIs; Pro logs in [2] | Live site, from outside (8 checks) [3] | Live site; optional code repo scan [4] |
| Passive only (no attack-style tests) | Yes | No [10] | No [2] | Yes [3] | Yes (URL scans) [4] |
| Ongoing monitoring | No (one-time scan) | Yes (Pro and up) [1] | Yes (Pro) [5] | No [3] | Yes (add-on) [4] |
| Pricing model | Pay per scan, no subscription | Subscription: Starter $24/mo, Pro $49/mo, Max $99/mo; 14-day trial [1] | See site [5][11] | Free problem list; $9 per fix report, $29 for 10 [3] | Free score; $19 one-time report; monitoring $99/yr or $12/mo [4] |
[1] CheckVibe pricing and plan comparison: https://checkvibe.dev/pricing (checked 10/19/2026). Lists 100+ security checks, Performance & Core Web Vitals, Accessibility (WCAG), Compliance & legal pages, Domain/DNS/certificate checks, dependency scanning (SCA), backend audit of "a connected Supabase project", and daily monitoring from Pro. Shows a "Create account" step and a 14-day free trial. Prices shown in USD on their plan table.
[2] Vibe App Scanner: https://vibeappscanner.com and https://vibeappscanner.com/pricing (checked 10/19/2026, via Scout). Lists JS-bundle secrets, Supabase RLS, Firebase rules, password policy, CSP/HSTS headers, auth flaws and source maps, and says it "tests your live database, auth, and APIs — not just headers". Pro deep scans "log in and test authenticated access". We found no speed, SEO, accessibility or library checks listed, and nothing on ownership verification or account requirements.
[3] vibecheck.ac: https://vibecheck.ac (checked 10/19/2026). 8 checks: secret keys, HTTPS, browser safety headers, framing, open database tables, title/description, sitemap/robots, broken links (up to 20). "No sign-up"; the free problem list needs an email. Read-only ("we only look"). If it finds a Supabase key, it asks for one row from common tables. It shows an "It's my app, or I have permission" checkbox but no ownership check. Pricing: $9 per fix report, $29 for 10, no subscription.
[4] getvibecheck.dev: https://getvibecheck.dev (checked 10/19/2026). URL scans: exposed keys, open Supabase tables (read-only), headers, HTTPS, public files; "We never log in, attack or crawl." Repo scans add known-vulnerable npm packages. Free score with "No signup" and "no email needed". $19 one-time Full Report; Monitoring $99/year or $12/month.
[5] Vibe App Scanner Pro plan (SPF/DMARC, breach checks, monitoring): https://vibeappscanner.com/pricing (checked 10/19/2026, via Scout).
[7] Database checks aren't available yet (TOV-119).
[8] Ownership row: CheckVibe's database audit uses a Supabase project you connect, so access comes from the owner [1]. vibecheck.ac, getvibecheck.dev and Vibe App Scanner test open tables, but their public pages don't describe an ownership-verification step [2][3][4].
[9] No account, email or code needed for the free scan: paste a link and it runs. One free scan per site. Email is optional, only to get the report sent.
[10] CheckVibe "Active security tests… non-destructive exploit attempts" (beta, on all plans): https://checkvibe.dev/pricing (checked 10/19/2026).
[11] Vibe App Scanner's pricing page and home page show different prices, so we don't quote one here. See https://vibeappscanner.com/pricing.
PreFlight sources: our check list (CHECKS-v1) and product copy (v7). "Passive" means GET/HEAD requests and public DNS lookups only: no logins, form submits, attack payloads or writes.
Questions
What does PreFlight check?
When free scans open, PreFlight will run 65 checks on your app the way any visitor could, across four areas: safety (exposed keys and files, HTTPS and security settings), speed, search and polish, and email setup and accessibility basics.
Is the scan safe for my site?
PreFlight only reads what any visitor could reach, plus your public DNS records. It doesn’t log in, guess passwords, submit forms or change anything, and it sends only a small number of requests, a couple at a time. It never uses secret keys. For database checks it uses the same public key your site already gives every visitor, only counts rows, and never keeps or shows their contents.
What doesn’t PreFlight check?
Anything behind a login, since we see your site the way a signed-out stranger does. On big sites we check a sample of pages and links. Speed is one load of your home page from our server, so real visitors’ speeds will differ. DKIM is checked only under common names, so “not found” doesn’t mean it’s missing. Some firewalls block scans, and those checks show as “couldn’t check”.
Do I have to prove I own the site?
Not for the free scan. Paste your link and it runs. To see the full report’s sensitive details, like exactly where an exposed key sits, you’ll verify the site is yours with a DNS record, an uploaded file or a meta tag. That way only the owner sees them.
If I pass 62 of 65, am I safe? Will it help my Google ranking?
Passing checks isn’t a guarantee. It means none of the 65 checks we ran found a problem. Other issues can still exist, so keep your own reviews and updates going.
Can I scan someone else’s site?
Only with their permission. You have to confirm that before scanning, and only a verified owner can open the full report.