Vibe App Scanner

Ship an AI-built app to production and there's a decent chance your API keys are in the client bundle, your Supabase row-level security is off, and your auth headers are missing. Vibe App Scanner points at your URL and runs 150+ checks tuned for exactly those mistakes, then hands you the fix as pasteable code your AI tool can apply.

What Vibe App Scanner actually does

You paste a URL, the scanner fingerprints the stack, and it runs a battery of tests written for the specific failure modes that AI coding tools produce — exposed secrets, broken RLS, missing security headers, auth flows that leak. What comes back is a ranked list with a plain-English explanation of each finding and remediation code you can drop straight into your editor.

• Auto-detect the stack — React, Supabase, Vercel, and 20+ platforms

• Run 150+ checks tuned for AI-coding failure modes

• Test authenticated flows to catch signed-in access-control issues

• Rank findings by severity so breach-worthy ones surface first

• Label each finding — exposed secrets, RLS misconfigs, missing headers

• Explain what an attacker could actually do with the flaw

• Compare scans across deploys to catch regressions

• Paste remediation code straight into your AI tool

The features that matter

These four are the reason to actually run the scanner instead of just skimming the OWASP top ten and hoping. Each one addresses a mistake that shipped-to-prod AI code makes on a daily basis.

• URL-to-scan in minutes — paste the URL and the tests fire.

• Ranked by severity — breach paths first, noise last.

• Progress tracking over time — the score climbs as you patch.

• Copy-paste remediation — the fix ships with the finding.

Who it's built for

The obvious buyer is anyone shipping apps built with Cursor, Lovable, Bolt, v0, or Claude — the tools that will happily let you push a Supabase service key to the client without flinching. Solo founders launching MVPs on the weekend, indie hackers with three side projects on Vercel, and small agencies delivering AI-built work to clients are the sweet spot. If your app went through a real security review before launch, you don't need this; if it went from prompt to production in a weekend, you probably do.

License Tier 1 is $49 and covers 15 scans per month across 3 websites — enough to cover a small portfolio of side projects. Tier 2 at $119 adds email breach monitoring, weekly scan automation, and MCP access; Tier 3 opens API access and unlimited sites. Priced against a single freelance security engagement, the lifetime math closes on the first serious finding.