Security audits for indie builders

Find your vices before attackers do.

VICE scans your product the way an attacker would: headers, TLS, exposed secrets, Supabase RLS. Then it hands you a clear score with the exact fix for every finding.

npm install -g vice-security

Trusted by builders shipping real products

Security reports you can actually read

No compliance theater, no fear-mongering. Findings, evidence, and the exact fix. Written for builders, not CISOs.

First results in about a minute

The light scan covers headers, TLS, exposed files and leaked secrets, then comes back with a score while other scanners are still warming up.

$ vice scan acme.dev
▸ headers ········· 12 checks
▸ tls ············· valid, HSTS on
▸ files ··········· no .env exposed
▸ supabase ········ 1 RLS gap
score 82/100 · grade B · 4 findings

Supabase Deep Scan

Every table, every policy, every storage bucket. VICE audits the RLS layer generic scanners don't understand, built for the stack you ship on.

A score worth showing off

One number out of 100, tracked over time, with an embeddable badge. Proof that your product takes security seriously.

An AI fix for every finding

Each finding ships with a plain-language explanation and the exact patch. Paste it into Cursor or your migration and move on.

-- ai fix · missing-rls-policy
- grant select on public.users to anon;
+ alter table public.users
+   enable row level security;
+ create policy "own rows" on public.users
+   for select using (auth.uid() = id);

One workspace per domain

Verify ownership once. Audits, modules, schedules and findings stay attached to the domain they belong to.

Verified domains go deeper

A DNS TXT record proves the domain is yours. Only then do the deeper checks unlock. VICE never runs intrusive scans on domains you don't own.

Evidence, not vibes

Every finding keeps its raw evidence next to the remediation, so you can verify the problem is real before you fix it.

GitHub Actions built in

Run VICE in CI and fail the build when a new critical lands. Reports and the score badge update on every push.

Audits on a schedule

Weekly or monthly runs keep the score fresh and catch regressions while you sleep.

Connect the tools you already use

Link GitHub through Webba ID, save the Supabase project once per domain, and let scheduled audits keep everything current.

GitHubSupabaseSchedules

CI checksAI FixScore badge

Support the open engine

VICE CLI stays free and MIT-licensed. GitHub sponsors keep it that way and get their logo in front of thousands of builders.

Try it on your domain

Public, non-intrusive checks with instant results. No account needed.

Full audits unlock after DNS verification

Target URL

Light scans only use public, non-intrusive checks.

Simple pricing for solo builders

Start free with public checks. Upgrade when a domain is worth defending.

Free

€0

Validate the basics before signup friction.

Public light scans

One tracked domain

Security headers and TLS checks

Manual domain verification

€9

/ month

For indie builders who ship often.

Verified full audits

10 audits per month

Supabase Deep Scan and AI fixes

Scan history and score tracking

GitHub Actions and scheduled audits

No credit card for the free tier · cancel anytime · See Pro and annual pricing