ID/ VBE-0X7
STATUSLIVE
CHECKS/ 310+
AVG/ <60S
VERIFIED BY/ ON-CALL SECURITY RESEARCHER
For founders shipping AI code

A security smoke test in under 60 seconds.

VibeEval probes your live app like an attacker would, then proves what's exploitable. A security engineer verifies every finding before it reaches you.

Scan my app → See a real finding ↓
Engineer-verified · 0 false positives · 24/7 coverage · ~60s to first proof

No signup needed: try our free Token Leak Checker — paste a URL, see exposed API keys in 5 seconds.

Need a signed report for a customer or auditor? That’s a scoped pentest engagement, not a smoke test.

LIVE PREVIEW

What's exposed in your app

Real product dashboard. Risk scores, finding trace, and fix guidance. Takes less than 60 seconds from URL to verdict.

app.vibe-eval.com/dashboard/projects
LIVE
VibeEval dashboard showing security findings across projects
PROOF vs NOISE

Scanners shout. Agents prove.

Every VibeEval finding ships with a captured exploit — request, response, reproducible PoC. If the agent can't prove it, or an engineer can't reproduce it, you don't hear about it.

[A] / TRADITIONAL SCANNER
“Possible SQL injection on /login”
  • Static rule matched a pattern in source
  • No real request made, no response captured
  • Eng has to reproduce it themselves
  • Ticket gets closed as "not reproducible"
confidence: 42% false-positive rate: ~70% action: file ticket, hope it's real
[B] / VIBEEVAL AGENT
“RLS bypassed. 1,204 rows extracted. Here’s the PoC.”
  • Live request fired, response captured
  • Exploit chain replayed in sandbox
  • Security engineer reproduces it by hand
  • Ticket ships with request, response, cURL
confirmed by: a human false-positive rate: 0% action: patch it
THE PROBLEM

The security gaps AI leaves behind

Working app, broken security model. We've reviewed every major AI coding tool — see the verdicts: Lovable, Cursor, Replit, Netlify, Cursor security risks, and the full safety hub.

Any user can see everyone’s data

Missing row-level security is the #1 vulnerability. Supabase tables readable by anyone with a browser console. AI skips the policy layer by default.

Your Stripe key is in your frontend

AI puts secrets in client code. Found in 1 of 4 apps scanned. Your bundle ships to every visitor — your keys ride along.

Your login has a backdoor

AI auth looks complete but breaks under testing. Endpoints without checks, tokens that never expire, role arrays a user can self-edit.

APPS
0+
Apps scanned
ISSUES
0+
Vulnerabilities found
CHECKS
0+
Security probes
AVG
0S
First scan time
METHOD

Scope · Attack · Verify · Report

No SDK, no config, no code changes. Four steps from URL to a ticket with a receipt.

Scope

Paste your URL. Agent maps every route, endpoint, parameter, and API. Works behind CAPTCHAs, auth walls, cookie banners.

Attack

Agent fires 310+ real probes — auth bypass, IDOR, RLS, exposed keys, SSRF. Continuously, not annually. Every deploy re-tested.

Verify

Exploit replayed in sandbox, then a security engineer reproduces it by hand. If a human can’t confirm it, it doesn’t ship to your inbox.

Report

Slack, email, or webhook. Every finding carries a receipt and a paste-ready fix prompt for Claude Code or Cursor.

That’s the smoke test — continuous, cheap, engineer-verified. For a scoped engagement with rules of engagement and a signed report, see pentest services.

WHY VIBEEVAL

Not another static scanner

Most tools scan code. We deploy an autonomous agent that tests your running application the way an attacker would.

DYNAMIC

Live app testing

We poke the running app. Static scanners read code and pray.

AGENT

Bypasses real-world blockers

CAPTCHAs, cookie walls, hosting checks. The agent plays human.

COVERAGE

Every API tested

REST, GraphQL, edge functions. Fuzzed, intercepted, compared across roles.

BROWSERS
0
CHROME · FF · SAFARI · EDGE
ATTACK

Real scenarios

310+ probes modeled on real incidents — not a CVE feed. Chains three to five steps per proven finding.

FIXES
RLS MISSING
EXPOSED KEYS
AUTH BYPASS
CORS OPEN
ROLE ESCAL
XSS SURFACES
SSRF PATHS
IDOR LEAKS
RLS MISSING
EXPOSED KEYS
AUTH BYPASS
CORS OPEN
ROLE ESCAL
XSS SURFACES
SSRF PATHS
IDOR LEAKS
FIX GUIDE

Claude-ready output

Each finding ships with a paste-ready prompt. Not a 40-page PDF nobody opens.

CHECKLIST
  • Dynamic testing
  • Multi-browser
  • Engineer-verified
  • MCP / Claude fix

A smoke test catches 80% of issues instantly. When a buyer wants the other 20% on paper, book a pentest.

PROOF LOG

12 proven issues.
First scan. 58 seconds.

A Lovable-built SaaS pointed VibeEval at their launched app. In under a minute, the agent proved twelve exploitable issues — including three criticals their checklist scan had marked "safe."

BEFORE · STATIC CHECKLIST
9 flags · 6 false positives
  • Ran once at launch, never again
  • Pattern matches in source code
  • No PoC, no reproduction steps
  • Criticals missed entirely
AFTER · VIBEEVAL AGENT
12 findings · 0 false positives
  • Live app probed in real browser
  • Every finding replayed end-to-end
  • cURL + Claude fix prompt attached
  • 3 criticals the checklist missed
LAST 5 RECEIPTS · DEMO FEED
14:03:41CRITRLS missing on public.users → 1,204 rows leaked
14:03:12CRITStripe pk_live_ found in /assets/app.js
14:02:58HIGHIDOR on /api/invoice/:id across roles
14:02:33HIGHRole field self-editable via PATCH /me
14:02:01OKRate-limit enforced on /auth/login
14:01:47CRITCORS * on credentialed endpoints
0 false positives ~12min median proof time
FREE TOOLS

Poke before you pay

Single-purpose checkers. Run them first. Upgrade when you want the full agent.

TOKEN-LEAK.scan
Finds API keys in your frontend bundle.
FIREBASE.rules
Checks Firestore rules for open reads.
SUPABASE-RLS.probe
Tests anon access to every public table.
HEADERS.txt
CSP, HSTS, X-Frame. Line-by-line verdict.
VIBE-CODE.audit
Audit your AI-generated repo.
NODE.JS.json
Dependency audit with CVE links.
HALLUCINATION.md
Catches AI-invented npm packages.
LOVABLE-PWD.gate
Tests password gates on Lovable apps.
PLATFORM AUDITS

Is your stack safe?

Straight-answer security reviews for every AI coding platform, host, and backend. Each grounded in actual scan data. Picking between two? See the side-by-side comparisons.

IS LOVABLE.safe
3 security gaps in every Lovable app — RLS, keys, BOLA.
IS REPLIT.safe
Public repls, Secrets in forks, AI endpoints without auth.
IS NETLIFY.safe
Build-log leaks, redirect rules, Functions auth.
IS CURSOR.safe
What Cursor-generated code ships missing.
FIREBASE-RULES.fix
12 Firebase security rule mistakes (with snippets).
CURSOR-RISKS.md
Cursor security risks: full risk profile.
BURP-SUITE.alt
9 Burp Suite alternatives — free + paid, compared.
ALL AUDITS.hub
Every safety review, hub-indexed.
[03]PRICING

Don’t be the founder whose users find it first

One tweet about your exposed database is all it takes. A $19 smoke test makes sure that trust is deserved. Need a report with a signature on it? Pentest engagements start at $2,900.

STARTER
PRO
$19/mo
Everything a solo builder needs to sleep at night.
  • Unlimited projects
  • 310+ security checks
  • Engineer-verified findings
  • RLS + credential leak probe
  • Daily re-scans
  • 24h email support
FIND MY VULNS →
MOST POPULAR
TEAM
TEAM
$79/mo
For teams shipping to regulated customers.
  • 5 seats included
  • GDPR / SOC2 / HIPAA gap analysis
  • Scheduled scans + shared reports
  • MCP + webhook API
  • Onboarding call
  • Priority support
START TEAM TRIAL →
BEST VALUE
LIFETIME
LIFETIME
$199once
Pay once. Scan forever. Launch pricing ends soon.
  • Everything in Pro
  • Real-time monitoring
  • 30-day money-back guarantee
  • Priority support
  • No renewal fees
LOCK IN LIFETIME →

30-day money-back · 14-day free trial · Cancel anytime · Enterprise: contact us →

FAQ

Honest answers to real questions

We know you're skeptical. Here's the truth.

Does VibeEval find real vulnerabilities?
Yes. Average scan finds 8–12 real issues on new AI-coded apps. We report CVE-grade findings with severity, trace, and fix — and a security engineer reproduces each one before it reaches you.
PROOFLIVE
→
Is a smoke test the same as a pentest?
No. The smoke test runs continuously and answers "did today's deploy break anything." A pentest is a scoped engagement with rules of engagement, authenticated multi-role testing, and a signed report your buyer or auditor accepts. Different questions, different price.
SCOPEREPORT
→
Is there a human involved, or is it all AI?
Both. The agent does the probing and discards anything it can't prove. Then a security engineer reproduces what survives, checks the severity is honest, and kills what doesn't hold up. That's where the zero-false-positive number comes from.
HUMANVERIFIED
→
Do I need this if I use Cursor, Lovable, or Bolt?
Especially then. AI tools ship working code but skip security primitives. We catch what the model left unlocked.
AICOVERAGE
→
How is this different from free scanners?
Free tools run static rules on code. We deploy an autonomous agent against the live app with real browsers and real payloads.
DYNAMICAGENT
→
Do I need security expertise?
No. Every finding is scored and paired with a one-paragraph fix prompt you can paste into Claude Code or Cursor.
NOOB OK
→
How long does a scan take?
First triage in under 60 seconds. Full deep-scan 3–8 minutes depending on route count and auth flows.
<60S
→
Will VibeEval break my app?
No destructive payloads by default. Production-safe mode runs read-only probes. Opt-in destructive tier needs explicit flag.
SAFEPROD
→
What's in the free trial?
14 days, no card. Full Pro feature set. Unlimited projects, full scan depth, daily re-runs.
14 DAYS
→
Can I share reports with investors?
Yes. Exportable PDF reports, signed with scan timestamps. Used in 40+ due-diligence rounds this year.
DD READY
→

Still have questions? → contact the team

ADVANCED

Static checklists are already outdated

Security advice has a ~6 month shelf life. VibeEval uses MCP to create a self-healing loop inside your editor.

[A] / OTHERS

Manual & static

  • Manual checklists
  • Quarterly dependency review
  • Static analysis on push
  • Annual pentest, then silence
  • Lag behind ecosystem
checklist.md — last updated 8 months ago
[B] / VIBEEVAL · MCP

Self-healing loop

  • Nightly cron scans via MCP
  • Auto-fix prompts for Claude Code
  • Continuous audit sessions
  • Vulnerabilities patched before push
  • Updated with real attack patterns
scanner → claude → fixed
FINAL CALL

Get a real receipt. Verified by a human.

Point VibeEval at your stack. See what breaks. Every finding lands in your inbox with a captured exploit, a fix prompt, and an engineer’s confirmation that it’s real.

  • SOLO · PRO OPEN ★
  • TEAM · 5 SEATS OPEN
  • LIFETIME · LIMITED OPEN ★
  • PENTEST · SCOPED CONTACT
FROM
$19 /MONTH · 14-DAY FREE TRIAL
APPLY · START FREE →