{ "openapi": "3.0.1", "info": { "title": "Vibe Code Security Scanner: Leaked API Keys, Supabase RLS", "description": "Scan any app built with AI (Codex, Cursor, Claude Code, Lovable, Bolt, v0, Replit) by URL for leaked OpenAI, Claude, Gemini and 60+ other API keys, open Supabase tables, source maps and missing headers. A-F grade, fix prompts. $0.05/site.", "version": "1.0", "x-build-id": "B8JDSvbljceHMHyfc" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/magnova~vibe-code-security-scanner/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-magnova-vibe-code-security-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/magnova~vibe-code-security-scanner/runs": { "post": { "operationId": "runs-sync-magnova-vibe-code-security-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/magnova~vibe-code-security-scanner/run-sync": { "post": { "operationId": "run-sync-magnova-vibe-code-security-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "urls" ], "properties": { "urls": { "title": "App URLs to scan", "type": "array", "description": "Deployed web app URLs to scan (Lovable, Bolt, Replit, v0, Vercel, Netlify, Cloudflare Pages, Firebase Hosting or any site built with Cursor / Claude Code). One site per URL; the homepage is enough, the scanner follows the app's own JavaScript bundles and lazy chunks. Only scan sites you own or are allowed to test. Example: https://myapp.lovable.app", "items": { "type": "string" } }, "iOwnThisSite": { "title": "I own these sites (enable database checks)", "type": "boolean", "description": "Tick only for sites you own or have written permission to test. Adds READ-ONLY checks of whether strangers can read your data: Supabase tables (RLS) and Storage, Firebase Realtime Database / Firestore / Storage, Base44 entities, Appwrite collections, PocketBase collections, Convex queries, Hasura/Nhost GraphQL and Parse/Back4App classes, plus exposed files like /.env and /.git/config. Nothing is ever written or deleted, row values are never stored, and secret keys found are never used.", "default": false }, "extraTables": { "title": "Your table / collection names (optional)", "type": "array", "description": "Owner mode only. Newer Supabase projects hide the table list from the public key, and minified builds can hide table names, so add any table names you know (e.g. profiles, orders). Each is tested read-only for public access, on top of the names found in your code and a list of common names.", "default": [], "items": { "type": "string" } }, "historyStore": { "title": "History store (track new / fixed issues)", "type": "string", "description": "Optional. Pick or create a key-value store in your account (e.g. one named app-security-history). The scanner remembers each site's findings there and marks every finding as new or unchanged, and lists what was fixed since the last scan. Use it with an Apify Schedule or a deploy hook." }, "onlyNewFindings": { "title": "Only report new findings", "type": "boolean", "description": "With a history store picked, only list findings that were not present in the previous scan of that site (the score and fixed list are still reported). Handy for scheduled or per-deploy scans.", "default": false }, "maxJsFiles": { "title": "Max JavaScript files per site", "minimum": 1, "maximum": 300, "type": "integer", "description": "How many same-site JavaScript files (entry bundles plus lazy-loaded chunks) to read per site. Big Next.js apps can have 100+ chunks. Example: 60.", "default": 60 }, "checkSourceMaps": { "title": "Reconstruct source maps", "type": "boolean", "description": "Download public .map files, list the original source files they expose and scan the original code for secrets.", "default": true }, "maxTables": { "title": "Max Supabase tables to test", "minimum": 1, "maximum": 200, "type": "integer", "description": "Owner mode only: upper limit of Supabase tables to test for public read access.", "default": 40 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }