What is a vibe coding security scanner?

It inspects AI-built apps for common mistakes such as exposed API keys, open databases, missing security headers, unsafe cookies and publicly reachable development files.

Can I scan my vibe-coded app for free?

Yes. MLVibeScan’s passive URL scan is free, needs no account and shows the grade, count, severity and repair area of findings.

Which tools does MLVibeScan support?

The scanner is generator-independent. It is suitable for Lovable, Bolt, Cursor, v0, Replit, Base44, Windsurf, Claude Code and apps using Supabase or Firebase.

Does MLVibeScan need GitHub or source-code access?

No. MLVibeScan tests the publicly deployed URL. Raw content is analyzed in memory and discarded afterwards.

Does the scan replace a penetration test?

No. It finds repeatable, automatable misconfigurations and supports regular re-testing. Business logic and complex roles need an individually scoped penetration test when the risk warrants it.

Vibe Coding Security

Scan your vibe-coded app for security vulnerabilities

A vibe coding security scanner checks an AI-built app for recurring security mistakes that are easy to miss when shipping quickly. MLVibeScan inspects what the live website actually delivers: JavaScript bundles, API endpoints, security headers, DNS, TLS and – after domain verification – database rules and abuse protection. The free external scan needs neither repository access nor an account and does not change the tested app.

Reviewed by René Matis · MATIS LABS · Updated 15 August 2026

The scan is free and takes about twenty seconds. You see straight away how many findings there are and how serious they are.

Scan your own app for free

What is vibe coding security?

Vibe coding security is the practice of securing applications created mainly with AI tools such as Lovable, Bolt, Cursor, v0, Replit, Base44 or Claude Code. These tools accelerate development, but they do not replace an authorization model, secure delivery or independent re-testing.

Recurring issues include publicly shipped API keys, missing Supabase Row Level Security, open Firebase rules, unauthenticated API endpoints, source maps, overly broad CORS and missing security headers. The app may still work perfectly, which is exactly why ordinary click-through testing misses them.

What does a vibe coding security scanner check?

The passive scan views your app like an external visitor. It reads shipped bundles, response headers, cookies, certificates, DNS records and public files, then compares indicators with vulnerability and supply-chain sources.

Active checks run only after payment and technical domain verification. With a small fixed request budget, MLVibeScan then tests database rules, publicly responding APIs, Google key restrictions, login protection and password-reset protection. These checks are read-only and are not load tests.

URL scanning and code scanning complement each other

A repository scanner finds unsafe patterns in source code. A URL scanner finds what build, hosting and configuration actually expose to the internet. Environment variables are inserted into JavaScript during the build; security headers and TLS are not in the repository; Supabase policies live in the database.

MLVibeScan focuses on this outside-in view. High-risk applications should add source review and an individually scoped penetration test. An automated report with no findings is a useful signal, not a guarantee of complete security.

How the security check works

Enter the public URL and confirm that you are authorized to test it. The free scan shows a security grade, finding totals, severity and repair areas, with some low-severity examples shown in full.

The complete report costs €9.49 once per domain. It includes locations, evidence, actionable fix instructions, PDF export and 90 days of re-tests. After a verified deep scan with no open critical or high findings, you may also activate a time-limited, revocable security attestation.

What we check automatically

Secrets and API keys in JavaScript bundles
Supabase and Firebase access rules
Security headers, CORS, cookies and TLS
Public files, source maps and development artifacts
Known package vulnerabilities and supply-chain indicators
API, login and password-reset protection after domain verification

Frequently asked questions

What is a vibe coding security scanner?: It inspects AI-built apps for common mistakes such as exposed API keys, open databases, missing security headers, unsafe cookies and publicly reachable development files.
Can I scan my vibe-coded app for free?: Yes. MLVibeScan’s passive URL scan is free, needs no account and shows the grade, count, severity and repair area of findings.
Which tools does MLVibeScan support?: The scanner is generator-independent. It is suitable for Lovable, Bolt, Cursor, v0, Replit, Base44, Windsurf, Claude Code and apps using Supabase or Firebase.
Does MLVibeScan need GitHub or source-code access?: No. MLVibeScan tests the publicly deployed URL. Raw content is analyzed in memory and discarded afterwards.
Does the scan replace a penetration test?: No. It finds repeatable, automatable misconfigurations and supports regular re-testing. Business logic and complex roles need an individually scoped penetration test when the risk warrants it.