Question 1

What is vibe coding?

Accepted Answer

Vibe coding is building apps using AI code generation tools like Lovable, Bolt.new, Cursor, Replit, and v0.dev. You describe what you want in natural language, and AI writes the code. It's fast for prototyping but often produces code with security vulnerabilities that need to be identified and fixed.

Question 2

How do I know if my web app is secure?

Accepted Answer

Enter your URL in vas for a security scan. We check security headers, scan for exposed secrets, test database access controls (Supabase RLS, Firebase rules), and identify vulnerabilities specific to AI-generated code. Results in minutes, not weeks.

Question 3

What platforms does Vibe App Scanner support?

Accepted Answer

vas scans apps built with any AI coding tool including Lovable, Bolt.new, Replit, Cursor, v0.dev, Windsurf, and Claude Code. We also test backend services like Supabase, Firebase, and PlanetScale, plus hosting on Vercel, Netlify, Render, and Cloudflare.

Question 4

How long does a security scan take?

Accepted Answer

A scan completes in 2-3 minutes and covers security, SEO, AI search readiness, performance, accessibility, compliance, and email. On the Pro plan we also run a weekly deep scan (20-30 minutes) that logs into your app and tries to reach other users' data across up to 150 pages. You'll receive an email when your scan is ready.

Question 5

Is my Lovable or Replit app ready for production?

Accepted Answer

Lovable and Replit ship functional code fast, but commonly leave hardcoded API keys, Supabase tables without RLS, and missing security headers. Run a vas scan before launch. We tell you what's open and give you copy-paste fixes your AI tool can apply.

Question 6

How much does a security scan cost?

Accepted Answer

Your first scan is free: you get your score, your issue counts, and one finding revealed in detail. Go is $19/month for 20 scans with every finding unlocked and a copy-paste fix for each. Pro is $39/month for 150 scans plus a weekly deep scan and weekly monitoring. Every plan runs the same full check suite, and you can cancel anytime. We're non-invasive and safe for production - no exploit attempts, just security analysis.

Question 7

What's the difference between the Go and Pro plans?

Accepted Answer

Coverage is identical on both - security, SEO, AI search readiness, performance, accessibility, compliance, and email. Go ($19/month) gives you 20 scans a month to run on demand across up to 3 projects. Pro ($39/month) raises that to 150 scans, adds a weekly deep scan that logs into your app and tries to reach other users' data across up to 150 pages, weekly automated monitoring, breach monitoring, and up to 10 projects.

Question 8

How is vas different from free header checkers?

Accepted Answer

Free scanners fetch one page and grade its response headers. vas tests your running app: it queries your Supabase and Firebase policies with your own public keys, probes auth and API endpoints, checks for SQL injection and exposed files, and digs through your JavaScript bundles for leaked secrets. On Pro, a weekly deep scan logs in with a test account and tries to reach other users' data. Header checks are a handful of the 150+ checks we run, not the whole product.

Question 9

Is vas safe to run on production apps?

Accepted Answer

Yes, vas is completely non-invasive. We only perform read operations - no exploit attempts, no data modification, no destructive testing. Our scans are safe for production environments and won't trigger security alerts or affect your users.

Question 10

What does vas actually look for?

Accepted Answer

The most common misses in AI-built apps: API keys exposed in JavaScript (OpenAI, Anthropic, Supabase service_role), missing Row Level Security so anyone can read your database, and security headers that leave you open to XSS or clickjacking. Plus auth flows, IDOR, mixed content, weak cookies, and more.

Question 11

How to secure a Supabase app before launching?

Accepted Answer

1) Enable RLS on ALL tables, 2) Create policies restricting access to user's own data, 3) Never expose service_role key in frontend, 4) Add security headers. vas tests your actual RLS configuration and shows which tables are exposed with SQL to fix them.

Stop your vibe-coded app getting hacked.

Checks per scan

To run your first scan

To your first report

One scan.
Everything checked. Fixed. Watched.

See exactly what's exposed

Your agent fixes it

Stay covered

Who is vas for?

Vibe coders

Developers

Agencies & teams

The numbers, in case you want them.

Where AI tools commonly slip up

What We Scan For

Vulnerabilities

Database & Auth

Secrets & Exposed Code

Configuration & Headers

Infrastructure & Platform

SEO & AEO

Accessibility & Compliance

Performance

Earn a Trust Badge

Run your first scan free.
Pay to unlock the full results.

Looking for a manual security audit or code review?

Frequently Asked Questions

Ship fast. Stay unhacked.

Security Guides & Resources

Platform Security Guides

Security Checklists

Is It Safe?

How-To Guides

Tool Comparisons

Vulnerability Database