vibecheck (themeridianlab.com)
A read-only inspection of a deployed URL, including Supabase keys and row level security, without uploading source.
Last updated
- Price
- $0
- Free tier
- Yes
- Checks
- Live URL, Supabase RLS, Secrets
- Last verified
- Oct 14, 2026
What the public pages say
Paste a URL you are allowed to inspect. The homepage says the check is read-only, does not ask for source code, and looks for Supabase project URLs, anon and service_role keys, public-readable tables, Firebase project settings, and secret patterns. It also says the free API is POST /api/scan with a consent flag, capped at 30 scans an hour per IP.
Do not treat the $29 and $99 rows as something you can buy today. The pricing page says Pro and Team launch when the GitHub App is ready, and that the free inspection already includes the detection coverage those plans will have.
Free tier
The pricing page lists Free at $0 with unlimited single-URL inspections and no signup. The same page's Free bullet says 'All 15 detector families,' while the comparison table on that page says 'All 23 detector families · 173 rules' are included on Free. Pro is listed at $29/month and Team at $99/month, and the page says those paid plans launch when the GitHub App is ready. The homepage says a free scan needs no auth, and that a deep scan (subdomain enumeration) is the paid call.
Left off the vendor's site
- Which detector count is current, 15 or 23. Both numbers are on the pricing page.
Sources
Listed on ShipSecurely
Put this on vibecheck (themeridianlab.com)'s site. The image links back to this page.
<a href="https://shipsecurely.dev/tools/vibecheck-meridian"><img src="https://shipsecurely.dev/badge.svg" width="196" height="32" alt="Listed on ShipSecurely"></a>
Markdown version · Canonical page: https://shipsecurely.dev/tools/vibecheck-meridian