You can't prove a website was vibe coded from the outside. You can see what the builder left behind, though, and most builders leave something: a default subdomain, a badge, a generator tag, a recognizable script path, or a backend called straight from the browser. Checking all five takes about five minutes and needs nothing but a browser.
TL;DR
Look at five things: the domain (lovable.app, bolt.host, replit.app), a builder badge, the page source (a generator meta tag or builder-specific script paths), and the network tab (direct calls to *.supabase.co). One signal is a hint, three is a strong indication, and none of them is proof. A paid plan and a custom domain can hide all of it.
Why people ask
Usually it's one of three situations. You're about to give a small SaaS your customer data and want to know how it was built. You're buying or investing in a product and the founder has been vague about the stack. Or you just saw a slick landing page and wondered.
The first two are really security questions wearing a different hat, and we'll come back to that at the end. First, the checks.
The five checks
Read the domain. The builders host your app for free on their own subdomain, and plenty of apps never move off it. Lovable's docs say publishing to a lovable.app URL "is free on all plans," with custom domains on paid plans. Bolt's docs say every project can publish to a .bolt.host domain and that Bolt picks a random name on first publish. Replit deployments land on .replit.app.
vercel.app and netlify.app prove nothing by themselves. v0 deploys to Vercel and Bolt still offers Netlify, but so do millions of hand-written projects.
Look for a badge. Scroll to the bottom-right corner. Lovable shows an Edit with Lovable badge on free projects. Its FAQ says hiding it is a per-project setting on paid plans, and that a hidden badge "returns on your next publish" after a downgrade. So a badge is close to conclusive, and a missing badge tells you very little.
View the page source. Right-click, View Page Source, then search (Ctrl+F or Cmd+F) for these:
name="generator". v0 apps have shipped<meta name="generator" content="v0.app">. A user on Vercel's community forum complained in September 2025 that they couldn't find it in their own code, and Vercel staff suggested overriding it inlayout.tsx. Unless someone removed it, a v0 site may still carry it.- Builder script paths. On a
lovable.appsite we checked on October 21, 2026, the HTML loaded/~flock.jsand/__l5e/events.[hash].jsalongside the app bundle. We haven't confirmed those paths survive a move to a custom domain, so treat them as a hint, not a rule. - A single hashed bundle like
/assets/index-BuUp7uXF.js. That's Vite's default output. Lots of builders use Vite, and so do lots of humans, so this one only counts alongside others.
Watch the network tab. Open DevTools (F12), go to the Network tab, and reload. Filter by supabase and then by firebase. A request to https://[project-ref].supabase.co/rest/v1/... with an apikey header means the front end talks to Supabase directly, which is exactly how Lovable and Bolt wire up their default backends.
You'll often find the key itself in the main JS bundle, either as a long JWT starting eyJ (the legacy anon key) or as sb_publishable_... (Supabase's newer key format). That's normal and by design. Hold that thought.
Weigh them together. A lovable.app domain plus the badge is about as certain as this gets. A custom domain, a hidden badge, a Vite bundle and a Supabase backend is suggestive, nothing more. Next.js on Vercel with no generator tag could be anything.
What these checks can't tell you
Plenty of AI-written code carries no fingerprint at all. Code written in Cursor, Claude Code or Copilot ends up as an ordinary repository deployed like any other, so there's no badge, no builder domain and no generator tag. From the outside, you can't see them at all.
And the builders let you erase their traces. A paid Lovable plan hides the badge and connects your domain. Removing a generator tag is a one-line edit. A team that cares about looking hand-built can look hand-built in an afternoon.
So the sites claiming to be a "vibe coded site detector" are reading the same signals you just checked by hand. They can't tell you more than this, and they'll miss everything that's been cleaned up.
The question you actually want answered
If you're evaluating a vendor, "was this vibe coded?" is a stand-in for "did anyone check this before it went live?" That's a fair worry, because the builders have a documented track record. In 2025 a researcher checked 1,645 apps from Lovable's public showcase and found 170 whose Supabase tables could be read without logging in. That became CVE-2025-48757. The cause was missing Row Level Security, which is the database rule that's supposed to stop a public key from reading everyone's rows.
That's why the Supabase key you found in step 4 isn't a finding by itself. Supabase's anon and publishable keys are meant to be public. Whether the data behind them is safe depends entirely on the table rules, and you can't see those from the browser.
Don't test someone else's database. Using a key you found in a site's bundle to query its tables is unauthorized access, even if the data comes back and even if you meant well. If you think a site is exposed, tell the owner. If it's your own app, test it properly: here's how to test your Supabase RLS.
For a vendor, ask directly: who reviews the code before it ships, are RLS policies enabled on every table, and when did someone last test them. A founder who built on Lovable and can answer those three cleanly is in better shape than one with a hand-written stack who can't.
For your own app, stop asking whether it looks vibe coded and check whether it leaks. That's the part that matters.
Is there a tool that can detect if a website is vibe coded?
Not reliably. Every vibe coded site detector works off the same visible signals covered here: the domain, a builder badge, generator tags, script paths and the backend the page calls. A site on a custom domain with the badge hidden and the generator tag removed looks like any other React app, and code written in Cursor or Claude Code leaves no builder fingerprint at all.
How can I tell if a site was made with Lovable?
Check for a lovable.app address and the Edit with Lovable badge, which Lovable shows on free-plan projects and lets paid plans hide. On a lovable.app site we checked in October 2026, the page also loaded scripts from /~flock.js and a /__l5e/ path. A custom domain plus a paid plan can remove all of the obvious signs.
Does a Supabase key in the page source mean the site is insecure?
No. Supabase's anon and publishable keys are designed to be public and ship in every Supabase front end. What decides whether data is exposed is Row Level Security on the tables. Don't test someone else's tables with their key: that's unauthorized access to their data, whatever your intent.
Why does it matter whether a site is vibe coded?
On its own it doesn't. What matters is whether anyone reviewed the code. Vibe coded apps have a documented record of shipping without database access rules, including 170 of 1,645 Lovable showcase apps in 2025, so it's a reasonable prompt to ask a vendor how they test security.
Built your app with AI?
Scan it for exposed keys, open tables and missing headers in 60 seconds.