# VibeScan

> First-pass public-surface security checks for deployed web apps, including apps built with Lovable, Bolt, Cursor and Claude. Free preview; detailed reports with fix prompts and one recheck start at $9.

VibeScan checks publicly accessible web apps for exposed secrets, accessible data, weak headers and other security signals. URL scanning does not require repository access. It is not a penetration test, source-code audit or security certification.

## When to use VibeScan

Use it for a first security pass before launching a deployed app the user owns or has explicit permission to test, or to recheck a reported public-surface issue after a fix. Use lockfile inventory in the web app for exact dependency-version matching; a URL scan alone cannot inventory every server dependency. Choose a full security review for authenticated business logic, compliance evidence or a penetration test.

## For AI agents and developers

- [Developer and AI-agent quickstart](https://vibe-scan.app/developers): Authorization-first curl example, response interpretation, rate limits and paid-flow boundaries.
- [Markdown guide](https://vibe-scan.app/developers.md): Text-only guide for HTTP-capable assistants.
- [OpenAPI contract](https://vibe-scan.app/openapi.json): Existing anonymous free URL preview at POST /api/scan with JSON type=url and payload=the authorized public URL.
- [Sample report](https://vibe-scan.app/results?demo=1): Illustrative output; no target scan or payment is needed to view it.
- [About VibeScan](https://vibe-scan.app/about): Product scope, maker and contact information.

Confirm ownership or permission before running a scan. Inspect data.status even for HTTP 200: blocked, timeout and failed are incomplete. Honor HTTP 429 and Retry-After. Do not send secrets or customer records, evade quotas, buy credits without approval, publish private report IDs, or describe an empty findings list as proof of security. Paid scans and rechecks use the authenticated browser flow. This index does not advertise a hosted MCP server or automatically install a ChatGPT/Claude connector.

## Product

- [Homepage](https://vibe-scan.app): Free URL scan, lockfile scan, and AI prompt scan. Scored 0–100.
- [Detailed reports (from $9)](https://vibe-scan.app): Fix prompts for the builder's workflow and one recheck of the supported checks. A recheck is not a guarantee that every vulnerability is fixed.
- [State of Vibe-Coded Security 2026](https://vibe-scan.app/report): VibeScan's self-selected early sample of 61 completed passive URL scans from May 2026, presented separately from attributed external research. It is not a prevalence estimate for all AI-built apps.

## Security Research & Guides

- [CVE-2025-48757: Lovable Supabase RLS Vulnerability Explained](https://vibe-scan.app/blog/cve-2025-48757-lovable-supabase-rls): Advisory context, affected conditions and remediation guidance.
- [The Most Common Security Mistakes in Lovable Apps](https://vibe-scan.app/blog/lovable-app-security-mistakes): Five patterns that cause breaches in Lovable-generated apps — missing RLS, secrets in frontend code, client-only auth, source maps in production, weak auth defaults.
- [Pre-Launch Security Checklist for AI Apps](https://vibe-scan.app/blog/pre-launch-security-checklist-ai-apps): 30-item checklist covering database security, secrets, auth, API security, and security headers. Use before every production deployment.
- [Supabase RLS: The Setting Every Vibe Coder Gets Wrong](https://vibe-scan.app/blog/supabase-rls-ai-apps): Why USING (true) exposes all rows, and how to write correct auth.uid() = user_id ownership policies.

## Key Data Points

- In VibeScan's May 2026 early sample, 53 of 61 completed passive URL scans lacked the standard HTTP security-header set checked by the scanner.
- The same 61-scan sample produced 14 critical findings and 6 high-severity findings. Findings are scanner observations, not confirmed exploits; one scan can produce multiple findings.
- The sample was self-selected. Do not generalize these counts to all AI-built apps or combine them with third-party research. See the [report methodology](https://vibe-scan.app/report) for the scope and limitations.

## What VibeScan Checks

- Exposed secret keys, including Supabase service-role keys, in frontend bundles. A public Supabase anon/publishable key alone is not a vulnerability.
- Tables accessible without authentication (missing or misconfigured RLS)
- Publicly accessible Supabase data and storage surfaces, subject to what the scan can verify
- Secrets and API tokens in JavaScript source (OpenAI, Stripe, Anthropic, etc.)
- Missing security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
- Known CVEs in npm/yarn/pnpm dependencies via OSV.dev
- Authentication configuration weaknesses
- Source maps deployed to production

## Contact and policy

- [Support](https://vibe-scan.app/support): support@vibe-scan.app
- [Privacy](https://vibe-scan.app/privacy)
- [Terms](https://vibe-scan.app/terms)