Do I need to install anything to scan my app?

No. VibeEval is a black-box dynamic scanner. You paste a public URL; a headless browser and a team of AI agents probe the deployed app from the outside. Nothing runs inside your codebase or infrastructure.

Can I scan localhost or a staging URL behind a VPN?

No. Only publicly routable URLs are accepted. Loopback, private-network, link-local, .local and .internal hosts are rejected before a scan starts. Deploy a preview URL (Vercel, Netlify, Fly) and scan that instead.

How long does the first scan take?

The automated pass typically finishes in 1–5 minutes and results stream in as they land. The scan then enters on-call review, where a security researcher verifies each finding by hand. You get an email when review is complete.

Getting Started: Your First Scan

1. Create an account

Sign up at app.vibe-eval.com/signup with email and password or Google. Passwords need 8+ characters, an uppercase letter, a number, and a special character.

A short onboarding asks about your role, what you want to test, team size, and whether you prefer a Fast (~5 min) or Deep (~30 min) default scan profile. The last step is plan selection — see Plans, billing and limits.

2. Add a target

A target is a URL VibeEval will test. Add one from Targets → Add target, or type it directly into New Scan and the target is created for you.

Rules that apply before anything runs:

Only http:// and https:// URLs. The scheme is added automatically if you paste a bare domain.
The host must be publicly reachable. localhost, private IPs, 169.254.169.254, .local, .internal, .test and similar are refused.
Government and military domains and a small denylist are refused outright.
You must own the app or have explicit written permission to test it. Accounts flagged for scanning third-party systems are suspended pending review.

Details in Targets.

3. Launch a scan

Open New Scan. The wizard has four steps: Target → Profile → Options → Launch.

For a first run, keep the defaults: the recommended DAST Full profile, no authentication, no exclusions. Click Launch Scan. You land on a launch screen while the job is queued, then on the scan detail page as soon as it starts.

Every option is explained in Running scans.

4. Read the results

The scan page shows a risk gauge (0–100), findings grouped by severity, and a status badge:

Status	Meaning
Queued	Waiting in the queue to start.
Running	Actively crawling and testing the target.
Pending review	Automated first pass finished. A security researcher is verifying results by hand, so they are not final yet.
Completed	Scan finished and reviewed.
Failed	Scan stopped before it could finish.

While the scan is pending review, findings carry a Preliminary badge. They may be confirmed, adjusted, or removed. You receive an email when review finishes.

Each finding includes CWE and OWASP references, a CVSS score, captured HTTP request/response evidence, remediation steps, and a before/after code fix where applicable. See Findings and Risk score.

5. Fix, then retest

Use Copy for LLM on the scan header to copy a Markdown report you can paste into Claude Code, Cursor, or Lovable. Once you have shipped a fix, click Retest on the individual finding, or Re-run Scan to test the whole target again. The re-run shows a diff against the previous scan: findings added, findings fixed, and the risk delta.

Where to go next

Reports and exports — PDF, JSON, CSV, and Markdown.
Trust badge — a live “Scanned by VibeEval” badge for your footer or README.
Webhooks and notifications — get told the moment something changes.

GETTING STARTED