ScanYourSite

Is this site vibe-coded? See which AI builder made it

Paste a URL. If we find a marker we trust for Lovable, Bolt.new, Base44, v0, Replit, Bubble, Softgen, Same.new, Anything (Create.xyz), Tempo Labs or Firebase Studio, we name the builder and show the marker. Weaker clues aren’t enough, so on some sites we stay silent — no name beats a wrong one. Then we check what sites like it usually get wrong: leaked keys, missing security headers, a page search engines see as empty. Free, no sign-up.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.

See a full example report

What one URL tells you

Check it yourself

These are clues you can look for by hand; the scanner names a builder only on a marker that can’t come from anywhere else, or on two independent ones, so it may stay silent where you find one.

  1. Read the page source

    Put view-source: in front of the URL and search the page (Cmd/Ctrl + F) for these strings — they come from the builders’ own templates, scripts and badges. The address is a clue too: *.lovable.app, *.bolt.host, *.base44.app, *.replit.app, *.bubbleapps.io and *.created.app belong to the builders themselves. Firebase Studio’s and Anything’s template title and description count only as a pair: the scanner names the builder when both are left untouched, not on the description alone. Bolt’s default preview image is a clue for you only: any page can link to it, so the scanner doesn’t name Bolt on it.

    view-source:https://example.com

Lovable   /__l5e/
Lovable   gpt-engineer-file-uploads
Bolt      bolt.new/badge.js
Bolt      bolt.new/static/og_default.png
v0        name="generator" content="v0.app"
Replit    replit-dev-banner.js
Replit    replit-pill
Base44    base44_access_token
Bubble    bubble_session_uid
Firebase  <title>Firebase Studio App</title>
Firebase  Generated by Firebase Studio
Anything  <title>Anything App</title>
Anything  Created with Anything
Softgen   cdn.softgen.ai/script.js
Same      same-runtime
Tempo     tempo-public-assets/error-handling.js

  2. Look at the response headers

    Some builders sign their responses. Bolt adds x-powered-by: Bolt.new on its bolt.host addresses; Bubble sends x-bubble-perf and x-bubble-capacity-* even on custom domains. A cache-tag ending in :studio points to a Firebase App Hosting backend named studio — the one Firebase Studio creates — but that is a clue for you only: the scanner doesn’t name a builder on it. Vercel, Netlify or Cloudflare in the headers name the host, not the builder.

    curl -sI https://example.com | grep -iE '^(x-powered-by|x-bubble|cache-tag)'

  3. Check the domain’s DNS by hand

    Connecting a custom domain leaves records behind. A TXT record at _lovable.<domain>, or the address 185.158.133.1, points to Lovable; a replit-verify= TXT record to Replit; a CNAME to base44.onrender.com to Base44. The scanner itself names Lovable on the address 185.158.133.1, and Replit only when replit-verify comes with Replit’s address 34.111.179.208. The _lovable TXT record and the Base44 CNAME are clues for you only: a record can outlive the site it was made for, so check it against the page itself.

    dig +short TXT _lovable.example.com
dig +short A example.com
dig +short TXT example.com | grep replit-verify
dig +short CNAME www.example.com

  4. Search the app’s own scripts

    DevTools → Sources, reload, then search every loaded file at once (Cmd/Ctrl + Option/Alt + F). These strings sit in the app’s own bundle, so they often survive a custom domain and even a move to another host. The Lovable one appears only in apps that use Supabase or Lovable Cloud. A blog’s bundle can quote these strings in a post, so the scanner names Lovable or Base44 on them only together with a second marker, and for Tempo looks for the code that defines TempoDevtools, not the word.

    Lovable   lovable-preview-auth
Base44    base44SharedInstances
Tempo     TempoDevtools

  5. Found nothing? That proves nothing

    Badges can be hidden, template text edited, projects exported to any host — and code written with Cursor, Claude Code or Copilot leaves no platform marker at all. Once built for production, hand-written and AI-written code look the same; no tool can honestly tell them apart.

Fixes go back into the builder

Every report ends with a prompt for an AI builder: what is wrong, where it is and how to check that the fix worked. Paste it into Lovable, Bolt, v0 or Replit Agent — or into Cursor.

Fix these issues on myapp.bolt.host. Locate each one before changing anything.

1. An OpenAI API key (sk-proj-…7fQ2) is in assets/index-5b0c.js.
   Revoke it in the OpenAI dashboard, move the call into a server function and read the key from an environment variable there.

2. The raw HTML has no meta description.
   Add a description and Open Graph tags to index.html so they exist before JavaScript runs.

When done, re-check: https://scanyoursite.app/en?check=myapp.bolt.host

Every prompt is a new deploy

An AI builder can rewrite half the app in one go. With Pro we notice each new version, check it within minutes and write only when something new breaks — in Telegram, by email or to Slack and Discord.

See plans

Questions

Can you tell whether the code was written by AI?

No — and nobody can honestly do that from the outside. Once code is built and minified for production, hand-written and AI-written code look the same. We don’t give an “AI probability”. We name a builder only on a marker we trust, and we show you which one.

No builder found — so it was made by hand?

Not necessarily. A site can be built with AI and carry no fingerprint at all: the badge was hidden, the template text edited, the project exported to another host, or the code written with Cursor, Claude Code or Copilot, which leave nothing in the site. No name means only that we found no marker we trust.

Which builders do you recognise?

Lovable, Bolt.new, Base44, v0, Replit, Bubble, Softgen, Same.new, Anything (Create.xyz), Tempo Labs and Firebase Studio. Some markers survive a custom domain; others appear only on the builder’s own address, such as *.bolt.host. For Bubble and Replit a marker proves the platform, not that its AI wrote the app.

Can I check a site that isn’t mine?

Yes. The free check is passive: it requests the page, its scripts, robots.txt, the sitemap, DNS and the certificate — what a browser or search crawler fetches — and identifies itself as ScanYourSiteBot. Deeper probes, such as the Supabase table check, run only on domains whose owner has verified them.

It’s my site and I don’t want it checked.

Enter your domain at scanyoursite.app/bot. It takes effect immediately and needs no account; the same page lists what our bot requests and the User-Agent it sends.

What does it cost?

The check is free, with no sign-up. Monitoring with a check after every deploy starts at $19 / €19 a month for three sites.

For vibe coders

Paste your URL. Get the list in about a minute.

Every finding comes with what it means for you and how to fix it — or a prompt your AI coding tool can apply.

Free, no sign-up. The basic check makes only the requests an ordinary browser would.