# VibeScan — security checks for AI-built web apps

VibeScan checks the public surface of deployed web apps for exposed secrets,
accessible data, weak security headers and other security signals. It is useful
for apps built with Lovable, Bolt, Cursor, Claude and other development tools.
No repository access is required for a URL preview.

## When to use VibeScan

Use it for a first security pass on a deployed app you own or are explicitly
authorized to test, or for a recheck after fixing a reported issue. Use lockfile
inventory in the web app for exact dependency-version matching. A URL scan alone
does not establish a complete inventory of server dependencies.

## Start with a sample or your own app

- [Open the scanner](https://vibe-scan.app/)
- [Illustrative sample report](https://vibe-scan.app/results?demo=1)
- [Developer and AI-agent guide](https://vibe-scan.app/developers)
- [OpenAPI contract](https://vibe-scan.app/openapi.json)
- [Machine-readable documentation index](https://vibe-scan.app/llms.txt)

## Run one authorized free preview

Confirm the user's ownership or permission before sending requests to a target.
Replace the placeholder below with that authorized app. HTTP-capable tools can
call the existing endpoint; ordinary chat alone may need the browser workflow.

```sh
curl --fail-with-body --max-time 35 \
  --dump-header vibescan-response-headers.txt \
  https://vibe-scan.app/api/scan \
  -H 'Content-Type: application/json' \
  --data '{"type":"url","payload":"https://your-app.example"}'
```

Inspect data.status in the JSON response. Only complete means the scan completed;
blocked, timeout and failed are incomplete, even when the HTTP response is 200.
An empty findings list is not a security certification. Honor HTTP 429 and
Retry-After (saved in vibescan-response-headers.txt by this example), and never
rotate identities to bypass quotas. Keep that local header file out of commits.

## Price and limitations

The free preview returns finding titles, summaries and severity counts. Detailed
fix prompts and one recheck start at $9 through the web checkout. Ask the user
before any purchase; the free API example does not spend credits.

This is a first-pass public-surface assessment, not a penetration test, compliance
audit, source-code audit or proof that an application is secure. Do not send
credentials, private URLs, customer records or secrets as scan input. Keep report
IDs and findings out of public posts without the owner's approval.

## About and evidence

- [About VibeScan](https://vibe-scan.app/about)
- [Research and its methodology](https://vibe-scan.app/report)
- [Security guides](https://vibe-scan.app/blog)
- [Support](https://vibe-scan.app/support)
- [Privacy](https://vibe-scan.app/privacy)

VibeScan's published early research uses a self-selected sample of 61 completed
passive URL scans from May 2026. It is separate from the live usage count and is
not an estimate of vulnerability prevalence across all AI-built apps.