Routelint
Record the calls a vibe-coded app already makes. Replay them with no session and as a peer. Read redacted evidence—no OpenAPI required.
Captured call
Critical
POST /api/search
{ "email": "[REDACTED]", "invoiceId": "inv-9001" }
Anonymous · 200 · same body returned to a peer account
What every security scan checks
Five test suites →API catalog
See every XHR and fetch the UI made
Unguarded access
Find data that returns with no login
Cross-user / IDOR
See if a peer can read someone else’s objects
Secret and PII exposure
Catch tokens, cards, emails, and hashes in responses
Sensitive paths
Probe /debug, /.env, and /actuator even if unlinked
The product
A browser session records the calls your vibe-coded app already makes. Those calls are replayed with no session and as a peer account. Forgotten paths are probed from a short list.
Primary · API security
No OpenAPI required. Capture XHR and fetch from the running app, then send each call again as anonymous, User A, and a peer. Findings cover unguarded routes, IDOR, secrets, and sensitive paths.
Also available · SEO & GEO
Paste a URL for scores on robots.txt, sitemap, llms.txt, on-page signals, and crawler access. Separate from the API suites—it does not scan your APIs.
SEO check
Search is scored from technical, on-page, and on-site signals. Answer engines are scored from crawler access, raw text, structure, and dates.
robots.txt, the sitemap, HTTPS, redirects, a viewport tag, and how long the page takes to answer.
Title length, the meta description, a single h1, image alt text, and whether the page has enough words.
A link to About, a link to Contact, an author, and a date a reader can find on the page.
GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and CCBot, plus a short /llms.txt map of the site.
Sentences that are already in the HTML, so a crawler that never runs a script can still read the page.
Headings, lists, and JSON-LD for the organization, an article, a product, or a person, with a modified date.
The product
Point Routelint at an application you own. It watches the interface, keeps the API surface, and checks whether those routes stay inside the right account.
01
Playwright follows the live UI and records XHR and fetch traffic, including query strings and JSON bodies.
02
Each captured call is sent again as anonymous, User A, and a linked peer, with the original URL and body.
03
Findings land in one place: suite, severity, route, and redacted evidence.
Features
Each suite answers one question: what the UI called, what returns without login, what a peer can read, what secrets appear, and which forgotten paths still answer.
01
See every XHR and fetch the UI made
02
Find data that returns with no login
03
See if a peer can read someone else’s objects
04
Catch tokens, cards, emails, and hashes in responses
05
Probe /debug, /.env, and /actuator even if unlinked
Guides
Each page answers a question people search before they know the name Routelint, then points at a redacted example or the public check.
How to do API testing for vibe-coded and AI-built apps: start from live UI traffic, not an OpenAPI file, and find unguarded leaks.
IDOR means User B can read User A’s object by reusing the same URL or body. How Routelint finds it from live traffic.
Test API auth and IDOR when you have no Swagger file: record browser XHR and fetch, then replay identities.
How to check APIs in apps built with Lovable, Cursor, or v0: capture live UI calls and find unguarded routes without OpenAPI.
When to use Routelint instead of ZAP, Burp Suite, or Postman for API security on vibe-coded apps.
An unguarded route returns account data when the request arrives with no session—a core finding in API testing for vibe-coded apps.
How it works
Replay stays read-only. Evidence is redacted before it reaches the database.
01
Paste the app URL, then prove the host with a DNS TXT record or a well-known file. The scan stays read-only.
02
A browser session follows the running app and keeps each XHR and fetch: method, query, body, status, and response.
03
The same call is sent again with no session, as User A, and as a peer account.
04
Tokens, emails, cards, and password hashes are stripped before a finding is written.
An account
The five suites are included on an individual account. Payments and daily scans are coming soon.
The crawler opens the app with no session. It records the calls a signed-out visitor can already make.
Paste a bearer token on a target you added. That scan sends Authorization: Bearer, so pages behind login are in reach. The token is stored encrypted.
The public check shows the scores and the name of each row. An account adds the evidence behind it.
A free account holds three targets. Identities, captured calls, and redacted findings belong to that account.
Questions
A scan without an account shows counts. Signup opens the suites. Payments and daily scans are coming soon.
