VibeScan

Name: VibeScan
Author: Gautam U

For developers: VibeScan detects security flaws in AI-built apps—exposed keys, CORS issues, missing rate limits—in seconds, no signup needed.

Built by Gautam U · Artificial Intelligence · Developer Tools · SaaS · Freemium

Visit website

In category: #608 of 2036 · Artificial Intelligence

Instant Launch listing

Listing status

36upvotes

Community score

Gautam U (Joined May 2026)

Founder

Compared against 3 alternatives

Market comparison

Launched on Launch Llama May 19, 2026 · #1 of 19 that day

About

VibeScan scans any public URL for security vulnerabilities common in AI-generated apps - exposed API keys, misconfigured headers, open CORS, missing rate limits, public source maps,
and more. Paste a URL, get a scored report in seconds. No signup required for free scans. Built for developers who ship with Cursor, Bolt, Lovable, and Replit.

Competitors: Snyk, Checkmarx, Semgrep, Burp Suite Community, OWASP ZAP

Key Features

Scan public URLs for security vulnerabilities in seconds
Detect exposed API keys and misconfigured authentication headers
Identify CORS misconfigurations and open endpoints
Flag missing rate limits on API routes
Locate public source maps and other information disclosure risks
Generate security reports without requiring account signup

Use Cases

Scan AI-built apps for exposed API keys, CORS misconfigurations, and missing rate limits with instant scored reports—no signup required
Use VibeScan's free scanning tool to audit apps built in Cursor, Bolt, Lovable, or Replit before shipping to production and catching common security gaps
Detect exposed source maps, misconfigured headers, and vulnerabilities specific to AI-generated code patterns in your deployed app
Scan competitor or third-party AI-built apps to understand common security flaws in the AI-generated app ecosystem
Integrate URL scanning into your workflow to test public endpoints after each build and fix security issues before release

Who it is for

Developers building apps with Lovable, Bolt, Cursor, or Claude who need a security check without sharing source code.
Founders and small teams shipping vibe-coded apps who want a quick first-pass security review of their deployed URL.

Pricing

Scanning is free with a free preview. Fix prompts and recheck start from $9.

View VibeScan pricing →

VibeScan at a glance

01What it is: VibeScan: For developers: VibeScan detects security flaws in AI-built apps—exposed keys, CORS issues, missing rate limits—in seconds, no signup needed.
02Pricing: VibeScan pricing: Scanning is free with a free preview.
03Best for: VibeScan is best for developers building apps with Lovable, Bolt, Cursor, or Claude who need a security check without sharing source code. and founders and small teams shipping vibe-coded apps who want a quick first-pass security review of their deployed URL.
04Alternatives: Top VibeScan alternatives on Launch Llama: Checkmarx, Vibetoolstack and Decloak.

Compare VibeScan with 3 alternatives

FAQ

What does VibeScan check?

VibeScan checks for exposed API keys and secrets in client-side JavaScript, misconfigured Supabase Row Level Security policies, missing or weak HTTP security headers, insecure authentication patterns, known CVEs in npm dependencies via OSV, and email security (SPF and DMARC). It scans the public surface of your deployed app without requiring GitHub access.

Do I need to give VibeScan access to my GitHub repository?

No. VibeScan scans the public surface of your deployed app — the same URLs and JavaScript bundles an attacker would see. You paste your app URL and check a box confirming you own it. No OAuth, no repository access, no code upload.

What AI-built app platforms does VibeScan support?

VibeScan works with apps built using any AI coding tool including Lovable, Bolt, Cursor, Claude, v0, Replit, and Windsurf. It also works with hand-written apps. If your app runs on a public URL with a Supabase backend, VibeScan can check its security surface.

How long does a VibeScan security scan take?

A free URL scan completes in about 30 seconds. The scan fetches your app, inspects the JavaScript bundle for exposed secrets, probes your Supabase public surface, and checks HTTP response headers — all in parallel.

Is VibeScan free?

The URL scan is free with no account required. It returns a prioritized list of findings. A paid report ($9) includes fix prompts you can paste back into your AI builder, detailed remediation steps, and the ability to re-scan after fixing issues.