Developer guide

Use VibeScan from your AI workflow

Run a first security pass on a deployed app you own or have permission to test. VibeScan checks its public surface without repository access and returns JSON findings. Start with an authorized free preview; keep purchases and account access under the user's control.

When to use it

Use VibeScan before launching a public Lovable, Bolt, Cursor, Claude or other web app, or after fixing a reported public-surface issue. For exact dependency-version matching, use the web app's lockfile inventory mode. A URL scan cannot inventory every server dependency.

Choose a full security review when you need authenticated business-logic testing, source review, compliance evidence or a penetration test. A completed scan and an empty findings list do not prove that an app is secure.

Run one free preview

First confirm ownership or explicit permission. Replace the placeholder below with the authorized public URL. No API key is required for this limited free endpoint. HTTP-capable coding agents can make this request; a chat assistant without HTTP tools can direct the user to the web scanner.

curl --fail-with-body --max-time 35 \
  --dump-header vibescan-response-headers.txt \
  https://vibe-scan.app/api/scan \
  -H 'Content-Type: application/json' \
  --data '{"type":"url","payload":"https://your-app.example"}'

This example does not request a paid scan or spend credits. It sends HTTP requests to the target and may save a report. Do not submit credentials, private URLs, customer records or secrets.

Read the result honestly

  1. Check the HTTP status. The example saves headers separately in vibescan-response-headers.txt, leaving JSON on standard output. A 429 includes Retry-After and quota headers. Wait for the advertised interval; do not switch IPs or accounts to evade the limit. Keep the local header file out of commits.
  2. For HTTP 200, inspect data.status. Only complete means the scan completed. blocked, timeout and failed mean incomplete evidence.
  3. Read data.summary and data.findings. Distinguish observed signals from confirmed exploitability, and preserve inconclusive or skipped checks.
  4. The free preview redacts detailed fix prompts. scan_id can be null if report persistence was unavailable. Never publish report IDs or findings without the owner's approval.

Pricing and integrations

The preview is free with rate limits. Detailed reports with fix prompts and one recheck start at $9 through the web checkout. Obtain the user's approval before buying anything. Paid scans and rechecks use the existing authenticated browser flow; there are no API keys or hosted MCP endpoint advertised by this guide.

Use the OpenAPI contract with an HTTP-capable agent, or open the sample report to understand the output before running a scan. Client setup differs between ChatGPT, Claude and coding tools; reading these docs does not automatically install an integration.

Evidence and support

See the research methodology for the scope of the published May 2026 sample. It is separate from the live usage count. Contact support@vibe-scan.app for help, and read the privacy policy before submitting data.