u/funfunfunzig

Still a bit stunned typing this. Three months ago I was refreshing Stripe hoping for one sale. Now there's a small but growing group of people paying every month to keep their apps from leaking.

CheckVibe is a security scanner for vibecoded apps shipped fast with AI tools. You paste a URL or hook up a GitHub repo and it surfaces what's leaking: secrets in the frontend, open database rules, missing headers. Two of us, fully bootstrapped, no funding. Three months in and we've done about $7k in gross volume, 200+ all time paying customers, 5k signups. Public Stripe link in case anyone's seen too many fake numbers: https://profile.stripe.com/checkvibedev/ZumatA0Y

A few things that actually worked:

TikTok slideshows have carried us. Aesthetic Pinterest-style backgrounds with tool names overlaid, five slides, no branding on the account. One hit a million views and is still quietly sending signups weeks later. 15 minutes to make. As a 2-person team that can't afford to spend hours on content every day, this format is unreasonably good.

Cold outreach worked, but only the version where I scanned the prospect's app first and DMed them what I found. Generic pitches got ignored. Useful findings got replies almost every time.

Paywall design was a 3x lever. The first version blurred all results, which felt clever and barely converted. Switched to one that just shows the count of critical issues with the actual findings locked. Conversion tripled. Curiosity beats obfuscation.

What nearly killed me was mobile activation tanking compared to desktop and not catching it for weeks. Onboarding had too many steps on small screens. Cut two and the gap basically closed overnight.

If you've shipped something with AI tools and haven't really checked what's exposed, checkvibe.dev runs in 30 seconds. Scan for free, only pay if you have issues. Almost every app I've scanned came back with something.

Still a bit stunned typing this. Three months ago I was refreshing Stripe hoping for one sale. Now there's a small but growing group of people paying every month to keep their apps from leaking.

CheckVibe is a security scanner for vibecoded apps shipped fast with AI tools. You paste a URL or hook up a GitHub repo and it surfaces what's leaking: secrets in the frontend, open database rules, missing headers. Two of us, fully bootstrapped, no funding. Three months in and we've done about $7k in gross volume, 200+ all time paying customers, 5k signups. Public Stripe link in case anyone's seen too many fake numbers: https://profile.stripe.com/checkvibedev/ZumatA0Y

A few things that actually worked:

TikTok slideshows have carried us. Aesthetic Pinterest-style backgrounds with tool names overlaid, five slides, no branding on the account. One hit a million views and is still quietly sending signups weeks later. 15 minutes to make. As a 2-person team that can't afford to spend hours on content every day, this format is unreasonably good.

Cold outreach worked, but only the version where I scanned the prospect's app first and DMed them what I found. Generic pitches got ignored. Useful findings got replies almost every time.

Paywall design was a 3x lever. The first version blurred all results, which felt clever and barely converted. Switched to one that just shows the count of critical issues with the actual findings locked. Conversion tripled. Curiosity beats obfuscation.

What nearly killed me was mobile activation tanking compared to desktop and not catching it for weeks. Onboarding had too many steps on small screens. Cut two and the gap basically closed overnight.

If you've shipped something with AI tools and haven't really checked what's exposed, checkvibe.dev runs in 30 seconds. Scan for free, only pay if you have issues. Almost every app I've scanned came back with something.

Sitting here a bit stunned. Just 10 weeks ago I was refreshing Stripe hoping for one sale. Now there's a small but growing group of people paying every month.

CheckVibe is a security scanner for vibecoded apps shipped fast with AI tools. You paste a URL or hook up a GitHub repo and it surfaces what's leaking. Two of us, fully bootstrapped, no funding. We're now at week 10 and we've done about $5k in gross volume, 180+ paying customers, 3.5k signups. Public Stripe link in case anyone's seen too many fake numbers: https://profile.stripe.com/checkvibedev/vZgeb2VM

A few things that actually worked:

TikTok slideshows have carried us. Aesthetic Pinterest-style backgrounds with tool names overlaid, five slides, no branding on the account. One hit a million views and is still quietly sending signups weeks later. 15 minutes to make. As a 2-person team that can't afford to spend hours on content every day, this format is unreasonably good.

Cold outreach also worked, but only the version where I scanned the prospect's app first and DMed them what I found. Generic pitches got ignored. Useful findings got replies almost every time.

Paywall design was a 3x lever. First version blurred all results, which felt clever. Barely converted. Switched to one that just shows the count of critical issues with the actual findings locked. Conversion tripled. Curiosity beats obfuscation.

What nearly killed me was mobile activation tanking compared to desktop and not catching it for weeks. Onboarding had too many steps on small screens. Cut two and the gap basically closed overnight.

If you've shipped something with AI tools and haven't really checked what's exposed, checkvibe.dev runs in 30 seconds. Almost every app I've scanned came back with something.

Happy to answer anything! Pricing, marketing, the stack, the build, whatever's useful.

Honestly still kind of in shock. Launched CheckVibe 6 weeks ago and just crossed $3k in revenue with over 100 paying customers and 2.5k signups.

It's a security scanner for vibe-coded apps built fast with AI tools like Cursor and Claude Code. Paste a URL or connect a GitHub repo and it flags what you forgot to lock down (misconfigured auth, public buckets, outdated deps with known CVEs, that kind of thing).

What actually worked

TikTok slideshows, weirdly. Bold text on a cream background, list of AI tools I use as a founder, no branding. One hit a million views and has been quietly driving signups for weeks. Ten minutes to make, best ROI of anything I've tried.

Cold outreach where I'd scan someone's app first and DM them the findings. Way better reply rates than generic pitches because you're literally handing them something useful.

What nearly killed us

Mobile activation was tanking compared to desktop because onboarding had too many steps on small screens. Once we cut a couple of steps the gap basically closed overnight. Also wasted a week trusting analytics data that turned out to be broken, always validate your tracking before making decisions on it.

6 weeks ago I was refreshing Stripe hoping for a single sale. Now there's a real, growing group of people paying every month. Long way to go but these are good days.

Most apps shipped fast with AI have at least one thing leaking that the founder doesn't know about. We've scanned hundreds and almost every single one had a critical finding. It takes 30 seconds, and you'll either get peace of mind or catch something before someone else does. It's checkvibe.dev for anyone who wants to try!

And drop your projects below, always love seeing what people are building 👇