Security scanner for vibe-coded apps — catches hardcoded secrets, unprotected routes, weak JWT secrets, unverified webhooks, and more before you deploy