Inspiration

With platforms like Lovable, Bolt, v0, and Replit, anyone can build and deploy a full-stack web application in minutes. However, because code is generated rapidly, basic security configurations are frequently overlooked. In production apps, developers accidentally leave Supabase databases open without Row-Level Security (RLS) or bundle elevated keys into frontend JavaScript. We built VibeGuard to find these leaks in real-time and alert developers before malicious actors exploit them.

What it does

Real-Time Discovery: Monitors Certificate Transparency (CT) logs to discover newly deployed applications across Lovable, Bolt, v0, and Replit the moment they go live.
Credential Extraction: Analyzes frontend bundles to detect exposed backend endpoints and API keys.
Permission Auditing: Safely tests whether critical tables (profiles, orders, leads) have Row-Level Security properly enforced.
PII Leak Detection: Scans sample rows to confirm if real sensitive data (emails, phone numbers, tokens, government IDs) is exposed to the public.
Zero-Downtime State Management: Built with atomic checkpoints and crash-safe resumption so audits never repeat or miss deployments.
Agentic & Voice Integration: Exposes a standardized Model Context Protocol (MCP) server enabling Alexa+, Bee (Wearable AI), and AI coding agents to trigger on-demand security scans and generate RLS patches via voice or tool calls.

How we built it

Language & Core: Python 3 with concurrent worker pools (ThreadPoolExecutor).
Cloud Backend: Cloudflare Workers edge serverless execution running 24/7.
Agentic Tool Protocol: Model Context Protocol (MCP) stdio JSON-RPC interface with tool schemas for Alexa+ and Bee integration.
Model Intelligence: NVIDIA Nemotron models (Nemotron-4 340B) via Nebius Token Factory for intelligent, context-aware PostgreSQL Row-Level Security policy synthesis.
Discovery Engine: Real-time Certificate Transparency log streaming.
Analysis & Heuristics: Custom regex token parsers and REST client auditing against standard PostgreSQL/Supabase endpoints.
Storage & State: Atomic JSON checkpoints with crash-safe signal handlers (SIGINT/SIGTERM).

Challenges we ran into

The hardest part was eliminating false positives. Many database rows contain placeholder mock data (like [email protected] or dummy phone numbers). We built multi-stage value validation heuristics so that VibeGuard only flags genuine, verified sensitive data leaks.

What next

Auto-Remediation PRs: Automatically generating the exact SQL / RLS policy needed to lock down the exposed table.
Developer Alerts: A web dashboard with Discord/Slack webhooks where creators can subscribe to instant security alerts for their domains.

AI & External Tools Disclosure

AI Tools Used: LLMs were used during prototyping to assist in drafting regex token heuristics and formulating standard PostgreSQL Row-Level Security (RLS) policy templates.
How They Were Used: All core scanner architecture, Certificate Transparency streaming, REST validation logic, and serverless edge endpoints were built, tested, and verified directly by the author.