Vibe App Scanner scans a live web app the way an attacker would, then hands back ranked vulnerability findings with a copy-paste fix for each one — built specifically for apps shipped quickly with AI coding tools like Lovable, Cursor, Replit, or Claude Code, where nobody necessarily reviewed the security of what got generated.
Your first scan is free; after that, paid plans start at $19 a month for occasional use and scale up to $39 a month for frequent, multi-project scanning.
What is Vibe App Scanner?
Vibe App Scanner is a young company, founded in November 2025 in Ontario, Canada, by two co-founders — including Jacob Perks — who between them have close to two decades in cybersecurity. Before building the product, they ran a code and security audit agency and kept seeing the same pattern in apps built with AI tools: exposed Supabase tables, service-role keys sitting in frontend code, APIs that trusted any user ID handed to them, and authentication that checked whether someone was logged in without checking what they should actually be allowed to see.
The product doesn’t name a single direct competitor, but it’s effectively positioned against generic website security scanners and manual penetration testing — the pitch is that it understands AI-generated stacks specifically, including distinctions a generic scanner commonly misses, like a public Supabase anon key versus a private service-role key.
Key features
Auto-detects your stack and runs 150+ checks
You enter a live app’s URL and Vibe App Scanner auto-detects the stack across React, Supabase, Vercel, and more than 20 other platforms, then runs over 150 checks tuned specifically for the mistakes AI coding tools commonly introduce. Optional login credentials let it test authenticated flows and catch access-control issues that only show up once a user is signed in.
Also worth a look: Headroom Review: Cut Claude Code and Codex Token Costs and LayerBack Review: Turn Diagram Images Into Editable Files.
Findings ranked by what would actually hurt you
Every finding is ranked by severity so the riskiest issues surface first, labeled clearly — exposed secrets, RLS misconfigurations, missing headers — with a plain-English explanation of why it matters and what an attacker could actually do with it, rather than just a CVE reference.
A security score you can track over time
The dashboard tracks every scan and a security score that should improve as findings get fixed, and lets you compare results across deploys or environments to catch a newly introduced vulnerability as soon as it appears.
Copy-paste fixes with the evidence behind them
Each finding comes with ready-to-use remediation code you can hand directly to your AI coding tool or editor, plus the raw JSON evidence behind the finding so you can verify exactly what was tested. MCP access means the scanner can connect directly into your AI coding workflow instead of requiring manual copy-pasting between tools.
Plans and pricing
Vibe App Scanner’s first scan is free, after which two monthly plans unlock ongoing scanning: Go for occasional use and Pro for frequent, multi-project monitoring.
| Plan | Price | Billing | Key limits |
|---|---|---|---|
| Free | $0 | One-time first scan | Full 150+ check suite; 1 finding revealed, rest locked |
| Go | $19/month | Monthly | 20 scans/month, 3 projects, every finding unlocked, on-demand rescans |
| Pro | $39/month | Monthly | 150 scans/month, 10 projects, weekly deep scans + monitoring, breach & email security checks |
Both paid plans include email breach monitoring, MCP and API access, and copy-paste fixes for every finding; what scales with price is how often you can scan and how many projects you can cover. Check vibeappscanner.com for the latest plan details.
Who it’s best for — and who should skip it
This is built for developers, solopreneurs, and agencies shipping apps with AI coding tools who do not have a security engineer checking their work before launch. Go’s 20 scans and 3 projects fit a solo builder running one or two live projects; agencies managing a roster of client sites will want Pro for the higher project ceiling and weekly automated monitoring.
It is not aimed at teams with an existing dedicated security review process or a professional penetration-testing budget — Vibe App Scanner is explicitly scoped to the kind of fast, automatable checks that catch common AI-generated mistakes, not a replacement for a full manual audit of a high-stakes application.
What users say
Early users describe the reports as genuinely actionable. One user tested it against a real Supabase and Vercel app with authenticated scanning enabled, called the findings actionable, and reported that after flagging a login issue and some feedback on scan coverage, co-founder Jacob reproduced the bug and shipped a fix quickly. Another reviewer praised how findings pair an explanation with evidence and a usable fix, specifically calling out MCP support for connecting the scanner straight into an AI coding tool. The consistent theme across early feedback is that the founders are personally engaged and fast to respond to bug reports and feature requests.
Price and value
At $19 a month, Go costs less than a single freelance security consultation and a fraction of a typical penetration test, while promising continuous monthly scanning instead of a one-time check. For solo builders shipping with AI tools, that combination of low cost and ongoing automated coverage is where the value case is strongest; agencies managing several client sites will find the jump to Pro worthwhile once they pass three live properties. The free first scan makes it easy to see your own results before paying anything.
Verdict
Vibe App Scanner targets a real and growing gap — security review for apps built faster than anyone is checking them — with a feature set that goes beyond a generic header scan, and early user feedback backs up both the usefulness of the findings and the founders’ responsiveness.
Frequently asked questions
Your first scan is free. After that, Go is $19/month for 20 scans and 3 projects, and Pro is $39/month for 150 scans and 10 projects.
Yes. The free plan runs the full 150+ check suite on your first scan, including your overall security score and one finding revealed in detail.
Paid plans are billed monthly with no long-term contract; check vibeappscanner.com for the latest billing terms.
It auto-detects more than 20 platforms including React, Supabase, and Vercel, and integrates directly with Supabase, Stripe, and Google Firebase for deeper checks.
Yes, you can add optional login credentials so it tests authenticated user flows and access-control issues, not just the public pages.
The $19/month Go plan includes 20 scans per month across 3 projects, with every finding unlocked, on-demand rescans, and copy-paste fixes.
Each finding includes ready-to-use remediation code meant to be handed directly to an AI coding tool like Lovable, Cursor, or Claude Code, or to a developer, to apply.
The vendor says it is tuned specifically for mistakes AI coding tools introduce, like distinguishing a public Supabase anon key from a private service-role key, rather than running a generic security-header checklist.
