Introduction
I build web apps with AI tools, and I kept shipping the same bug.
Not a crash. Nothing that showed up in testing. The app worked, the demo went fine, and somewhere in it was a database rule that had never been switched on, or an API route that returned a record without checking who was asking. The kind of thing that looks completely healthy from the outside and is completely open from the inside.
I built Vibe App Scanner because I wanted to know that answer about my own apps before anyone else found it out for me.
The Problem
AI coding tools optimise for working software, not safe software. Ask for a feature and you get a feature. You do not get the permission check that should sit behind it, because you did not ask for one and the model had no reason to add it.
That produces a specific failure. Your app is not broken. Your app runs, signs people in, and stores their data correctly. It just also lets the wrong person read it.
We scanned 1,487 domains to see how common this really is. 28.6% had a critical or high severity finding, and 10% had a critical. The single biggest source was databases with their access rules turned off, which is the default state that never got changed before launch.
The harder part is that none of it is visible from the outside. The page returns 200 whether your access rule works or not. You cannot spot it by looking at your site, and neither can a scanner that only looks at your site.
The Solution
Vibe App Scanner signs in and tries it.
Give it your app URL and it runs a security scan in two to three minutes, checking headers, exposed keys, database exposure, and the configuration issues that show from outside. That part is table stakes.
The part that matters is optional test credentials. Hand those over and the scanner logs into your application as a real user, submits your forms, and attempts to read records belonging to somebody else, across up to 150 pages. That is the only way to find out whether your authorization actually holds, because a request from a valid session that returns the wrong data looks perfectly legitimate to anything watching from the edge.
Every finding comes back with the specific fix, written to paste straight into Cursor, Claude Code, or whatever tool you built with. You are not handed a PDF and left to interpret it.
Key Features
-
Authenticated testing: signs into your app with test credentials and tries to reach another user's data across up to 150 pages. This is the check that finds the failure AI-built apps actually have, and it cannot be done from outside.
-
Copy-paste fixes for AI coding tools: every finding ships with the exact change to make, formatted for the assistant you already use. The fix is the product, not the finding list.
-
Weekly automated re-scans: on the Pro plan your app is re-tested every week, including the authenticated pass, plus breach monitoring against known credential dumps and SPF, DMARC and DNSSEC checks on your sending domain. You ship on Thursday and find out on Sunday, rather than never.
Frequently Asked Questions
What problem does Vibe App Scanner solve?
It tells you whether your app leaks other people's data before somebody else discovers it does. Specifically it finds the failures that AI coding tools reliably produce: database access rules never enabled, API routes that skip the ownership check, secrets left in the browser bundle. In our own data, 28.6% of the 1,487 domains we scanned had a critical or high severity issue, and almost none of their owners knew.
Who should use Vibe App Scanner?
People shipping real apps built with AI tools, especially anything holding accounts, user data or payments. If you built it with Lovable, Bolt, Cursor, Replit or v0 and it now has users, that is exactly the case this was built for.
It is less useful if you are shipping a static marketing site with no login and no database. There is not much for the authenticated pass to test.
When is Vibe App Scanner the right choice?
Before you send real traffic to something, and again whenever you add a feature that touches user data. Those are the two moments the failure gets introduced.
It is also the right choice when you already suspect something is wrong and want a specific answer rather than a general worry. A scan gives you a named finding and a fix, which is more useful than a checklist telling you to think about security.
How is Vibe App Scanner different from alternatives?
Most scanners check what is visible without credentials: headers, TLS, exposed files, dependency versions. That is genuinely useful and several tools do it faster than we do, some returning a full report in around sixty seconds.
We take longer because we sign in. An external scan cannot tell you whether user A can read user B's records, and that is the failure that actually costs people their apps. We would rather take three minutes and answer that question.
The second difference is what you get back. Findings arrive with the exact fix written for your AI coding tool, because the person who built the app with AI is going to fix it with AI too.
Conclusion
Most people building with AI tools are not careless. They are moving quickly with tools that produce working code and stay quiet about everything working code leaves out.
The gap between "it works" and "it is safe" is not obvious from the outside, which is the whole problem. It takes a couple of minutes to find out which side of that gap your app is on.
Your first scan is free, no card required. Paste your URL at vibeappscanner.com and see what comes back.