Vibe App Scanner

People who build apps with AI code generation tools like Lovable, Bolt.new, Cursor, Replit and v0.dev can ship quickly, but the generated code often contains security vulnerabilities such as exposed API keys, missing row-level security, and broken authentication. The page cites research showing 45% of generated code failed security tests in one study and describes real disclosures of public access to private data in Lovable apps using Supabase. Today these builders typically have no structured way to find or prioritize these issues before deploying to production. Left unchecked, these gaps can expose private user data or secrets, with the page noting average data breach costs of $120K to $1.24M for startups.

Vibe App Scanner runs a live scan of a deployed app's reachable pages and endpoints, checking across 150+ checks in 8 categories including vulnerabilities, database and auth (e.g. Supabase RLS, Firebase Rules), secrets exposure, headers, infrastructure, SEO/AEO, accessibility and performance. Each finding includes evidence (such as the actual data returned by a request), a severity rating, and an 'Export for AI' option so the report can be pasted into a coding tool like Claude or Cursor to propose and review a fix before re-scanning to verify it. Developers can also drive scans via MCP from Claude Code or Cursor, or use structured findings and SARIF output. Paid Pro plans add weekly automated deep scans, monitoring with alerts, and breach/email security checks, and apps that pass with no critical or high findings can display a public trust badge.