API testing for vibe-coded apps

Apps built in Cursor, Lovable, v0, and similar tools often ship a working interface first. The browser already knows which APIs matter: every XHR and fetch on the running page. Classic API testing starts from OpenAPI or Postman collections. That misses routes the UI opened that never made it into a document.

Routelint’s approach is API security testing from observed traffic. You prove you own the host, a browser session records method, path, body shape, and status, then the same calls are replayed with no session, as User A, and as a peer. A 200 that still returns account data is an unguarded route. A peer that can read someone else’s object is cross-user / IDOR. Secrets and forgotten paths such as /.env are checked in the same run.

You do not upload a Swagger file to start. Replays stay read-only by default. Evidence is redacted before it is stored. Use a free site scan for counts, or open the API leak scan when you want the full suites after signup.

If you also care how the marketing site reads to search and answer engines, that is a separate product: the SEO and GEO check. It scores public HTML, robots.txt, and llms.txt. It does not replace API testing for vibe-coded apps.