Built for teams shipping fast with AI

Ship fast. Know what you shipped.

VibeScan is security scanning for AI-generated code and live endpoints — built to catch the mistakes fast-moving teams miss, before your users find them for you.

See a sample report

NO SOURCE CODE RETAINEDCONSENT-BASED SCANNING

vibescan --target appsecco/dvna

$ [init] authorization verified — repo scan

$ [static] analyzing 214 files...

$ [secrets] 1 credential found in config/aws.js

$ [deps] 6 packages with known CVEs

$ [sql] unsanitized query in appHandler.js:11

$ [done] report ready — 6 high, 19 medium

THE PROBLEM

AI writes code fast. It doesn't write it safe.

Generated code ships with the same handful of mistakes, over and over — and most teams have no review step built for that.

Secrets, committed

API keys and tokens end up in git history or client bundles because no one told the agent not to hardcode them.

Copy-pasted vulnerabilities

The same SQL injection and SSRF patterns, reproduced across every AI-generated endpoint.

Misconfigured by default

Dockerfiles running as root, wildcard CORS, missing auth checks — defaults nobody reviewed.

No rate limiting

Endpoints vulnerable to denial-of-service because the boilerplate skipped safety layers.

Open database rules

Permissive Firestore or S3 policies generated as "starter" code that never got tightened.

Unverified webhooks

Signature verification omitted, letting an attacker forge a payment or event callback.

SEE IT IN ACTION

See a real scan, start to finish.

Watch a real scan run against a live site and a GitHub repo — and see what comes back.

45 SECONDS · SOUND ON

HOW IT WORKS

Two ways in, one clear report.

Website scan

Verify domain

Place a TXT record to prove ownership before any scanning begins.

Live crawl

Passive + light-active checks audit your endpoints for client-side leaks and exposure.

Full report

Plain-English findings with fixes — not a raw JSON blob.

GitHub repo scan

Connect a repo

Authorize read access to a GitHub repository, public or private.

Static analysis

Code, dependency, and secret scanning across the checkout.

Findings report

Remediation guidance for every vulnerability class the tools catch.

TRUST & SAFETY

We only scan what you've explicitly authorized.

Every scan requires domain ownership verification or repo-level authorization, signed and logged before we run a single check. Nothing is scanned silently.

Read the authorization model

Domain and repo access require signed authorization before any scan starts

Every authorization is logged with a timestamp and IP for your audit trail

Secret detection reports only that a credential exists — never the value itself

No source code is retained after a scan completes

SAMPLE REPORT

Severity-first, from the first glance.

CriticalInsecure admin route exposure

/api/v2/user/delete

Why it matters

An attacker could enumerate user IDs and delete records without authenticating.

The fix

Add requireAuth middleware to the route definition.

MediumPassive info leak via proxy headers

/server/proxy-config

Why it matters

Origin-revealing headers let attackers bypass WAF protection by hitting the origin directly.

The fix

Strip origin-identifying headers before forwarding requests.

AUTOMATE IT

Trigger scans from your own tools, not just the dashboard.

Every domain and repo you've already authorized can also be scanned programmatically — same authorization model, same findings, different entry point.

REST API

List your verified domains and repos, trigger a scan, and read findings with a single API key against /api/v1. Generate keys from the dashboard.

Read the API docs

MCP server

Connect VibeScan to Claude Code, Claude Desktop, Cursor, or any MCP-compatible coding agent, so it can check for known issues and kick off a scan mid-session.

Read the MCP docs