VIBE CODE SCANNER

What is a vibe code scanner?

A vibe code scanner is an automated security tool that probes a live AI-generated web app for the specific failure modes that AI coding tools tend to ship: exposed API keys in the browser bundle, missing Row Level Security on Supabase and Firebase tables, admin routes without auth checks, and open storage buckets. It runs against your deployed URL, no source code required, and returns findings in under two minutes.

This scanner covers apps built with Lovable, Bolt.new, Cursor, Claude Code, v0, Replit, Base44, Figma Make, and Windsurf — the full family of AI-generated-app tools — and everything they typically deploy onto (Vercel, Netlify, Railway, Render, Fly.io).

Traditional SAST assumes you have a clean checkout and that security lives in source. Vibe-coded products often fail in configuration and runtime: dashboard toggles, build-time env inlining, host defaults. A vibe code scanner starts where the attacker starts — the public URL.

The vibe-coded app security checklist

AI coding tools have a family of recurring gaps. This scanner tests all of them in one pass:

• Missing Row Level Security on Supabase or Firebase tables
• Exposed API keys in the frontend bundle (Stripe secret, Firebase service account, OpenAI, Anthropic, AWS)
• Auth flows that check the user but skip role or permission checks
• CORS set to * on endpoints that return sensitive data
• Debug routes and admin panels that shipped to production
• Public storage buckets with no ACL
• Inline scripts that force an unsafe Content Security Policy
• Webhooks with no signature verification
• eval() or remote-code execution of user input
• BOLA/IDOR on generated CRUD
• Preview or staging hosts that share production secrets

Map these to OWASP language on OWASP Top 10 for AI Code.

What the scanner detects

Deep agent mode extends the surface pass with multi-step role testing, richer API mapping, and fix prompts tuned for your stack.

How to use

1. Paste the URL of your deployed app into the scanner at the top of this page.
2. Wait ~2 minutes — the scanner loads the app, captures every request, and probes common attack surfaces.
3. Review findings by severity: Critical, High, Medium, Low. Each includes evidence (which URL, header, or bundle triggered the detection).
4. Copy the fix prompt into Claude Code, Cursor, or Lovable to patch the issue.
5. Rescan to confirm the fix before you ship.

Optional for deep scans: provide two test logins so cross-user checks can run without guessing. Never paste production admin passwords into tools you do not trust — use dedicated staging users.

Which AI coding tools have the most common issues?

Hosts matter too: Vercel previews, Railway public DB proxies, and Netlify redirect mistakes show up as environment misconfiguration on top of AI code gaps.

Why runtime beats source-only for vibe code

AI apps often have correct-looking source and broken configuration:

• RLS policies only exist in the Supabase dashboard (or not at all).
• Firebase rules never left the console “test mode” toggle.
• Env vars are injected at build time and only appear in the shipped bundle.
• Preview hosts skip middleware because of a matcher bug.
• Storage buckets are public in the cloud console, not in git.

A repo SAST pass can be green while the live URL dumps every orders row. This scanner works from the outside — the same vantage as a real attacker — so configuration drift shows up.

That does not mean you should skip SAST. Use both: Semgrep/ESLint in CI, vibe scan on deploy. See Between SAST and Pentest.

Surface scan vs deep agent

Start free. Graduate to deep when you handle real user data or payments.

Interpreting severity

• Critical: secret keys in the bundle; anonymous full-table reads; service_role exposure; unpaid → paid without verification.
• High: BOLA on primary objects; open admin routes; public private documents in storage.
• Medium: missing headers, open redirects, verbose errors, overly broad CORS without obvious data loss yet.
• Low: informational hardening gaps.

Ship blockers are Critical and High on production with real users. Mediums become highs when chained (open redirect + token in query string).

How to verify a fix

1. Apply the fix (or paste the finding prompt into Cursor / Lovable / Claude Code).
2. Deploy to the same environment you scanned (preview or prod).
3. Rescan the same URL.
4. Confirm the finding is gone and no new criticals appeared.
5. For RLS fixes, also run the Supabase RLS Checker as a second opinion.
6. For key leaks, rotate the key first — rescan alone is not enough if the old key still works.
7. For BOLA, re-run two-account manual confirmation on the fixed route.

Common mistakes when using a vibe scanner

• Scanning localhost only and never the production domain (CDN, env, and headers differ).
• Ignoring Medium findings that are open redirects or missing headers — attackers chain them.
• Fixing the UI auth check but not the API/RLS layer the scanner actually hit.
• Leaving preview URLs open after a clean production scan.
• Not rotating keys the scanner found — bots may already have them.
• Treating one green scan as forever — the next AI prompt can re-open a table.
• Scanning only marketing domains while the app lives on app. subdomain.
• Sharing deep-scan credentials that are also production admin accounts.

What to scan on every release

• Production canonical URL (custom domain).
• Staging / preview if it shares production data or keys (ideally it does not).
• Marketing site only if it embeds the same Supabase/Firebase project as the app.

Integrate the deep scan as a CI step against preview deploys when your host supports stable preview URLs (Vercel, Netlify, Railway).

# Conceptual CI step after preview deploy
- name: VibeEval preview scan
  run: vibeeval scan --url "$PREVIEW_URL" --fail-on high

Fit in a broader program

None replaces the others. Velocity without the live layer is how “we use Snyk” still ships open RLS.

Logging, monitoring, and abuse (1)

Log authentication failures, authorization denials, and high-cost endpoints with request ids. Alert on spikes. Rate limit auth and AI proxy routes. For vibe-code-scanner, define what ‘abnormal’ looks like before an attacker teaches you under load.

# smoke verification sketch for vibe-code-scanner
curl -s -o /dev/null -w '%{http_code}\n' "$PREVIEW_URL/healthz"

Dependency and supply chain (2)

Lockfiles, immutable CI installs, pinned GitHub Actions, and verification of packages the model suggests. Hallucinated package names are a real path. On vibe-code-scanner changes that touch package manifests, require a human to open the registry page once.

// deny-by-default sketch used near vibe-code-scanner
export function assertOwner(userId: string, ownerId: string) {
  if (userId !== ownerId) throw new Error('forbidden');
}

Human process and training (3)

New engineers should break a demo app on purpose, fix it, and rescan. That training beats a PDF policy. For vibe-code-scanner, keep one golden path example of a secure change and one of a rejected insecure change in internal docs.

Operational checklist for vibe-code-scanner (4)

Treat vibe-code-scanner as a production surface with an owner, a review cadence, and a verification step after every AI-assisted change. Write the owner name in the repo SECURITY.md. Schedule a monthly re-read of controls that touch authentication, secrets, and data access. When an agent opens a PR against this area, require dual-user tests and a preview scan before merge. Keep a short incident appendix: which keys to rotate, which dashboards to check, who communicates with users.

# smoke verification sketch for vibe-code-scanner
curl -s -o /dev/null -w '%{http_code}\n' "$PREVIEW_URL/healthz"

Common AI-generator mistakes on vibe-code-scanner (5)

Generators optimize for demos: open data paths, client-trusted roles, missing rate limits, and secrets in env files that ship to browsers. On vibe-code-scanner, re-check those classes after every feature prompt. Search diffs for deleted middleware, new admin routes, and dependency adds. Reject ’temporarily disable auth’ comments without a tracking ticket and expiry.

Verification commands and proofs (6)

Proof beats intention. For vibe-code-scanner, keep a script or checklist that demonstrates deny paths: anonymous access fails, user A cannot read user B, webhooks reject bad signatures, and bundles lack server secrets. Store the last run date next to the checklist. If the date is older than your release cadence, you are flying blind.

// deny-by-default sketch used near vibe-code-scanner
export function assertOwner(userId: string, ownerId: string) {
  if (userId !== ownerId) throw new Error('forbidden');
}

CI and release gates (7)

Encode the minimum bar in CI so humans do not renegotiate under launch pressure: secret scan, dependency audit, unit tests including authz negatives, preview deploy, live security scan failing on criticals. For vibe-code-scanner-related paths, add CODEOWNERS so reviews land on people who understand the threat model.

# smoke verification sketch for vibe-code-scanner
curl -s -o /dev/null -w '%{http_code}\n' "$PREVIEW_URL/healthz"

Environment separation (8)

Production credentials must not appear in previews or local agent sandboxes. Separate projects or branches for data stores, separate OAuth redirect allowlists, and separate Stripe test vs live keys. Document the matrix where coding agents can read it so ‘make preview work’ does not copy prod secrets again.

Logging, monitoring, and abuse (9)

Log authentication failures, authorization denials, and high-cost endpoints with request ids. Alert on spikes. Rate limit auth and AI proxy routes. For vibe-code-scanner, define what ‘abnormal’ looks like before an attacker teaches you under load.

Dependency and supply chain (10)

Lockfiles, immutable CI installs, pinned GitHub Actions, and verification of packages the model suggests. Hallucinated package names are a real path. On vibe-code-scanner changes that touch package manifests, require a human to open the registry page once.

# smoke verification sketch for vibe-code-scanner
curl -s -o /dev/null -w '%{http_code}\n' "$PREVIEW_URL/healthz"

// deny-by-default sketch used near vibe-code-scanner
export function assertOwner(userId: string, ownerId: string) {
  if (userId !== ownerId) throw new Error('forbidden');
}

Human process and training (11)

New engineers should break a demo app on purpose, fix it, and rescan. That training beats a PDF policy. For vibe-code-scanner, keep one golden path example of a secure change and one of a rejected insecure change in internal docs.

Operational checklist for vibe-code-scanner (12)

Treat vibe-code-scanner as a production surface with an owner, a review cadence, and a verification step after every AI-assisted change. Write the owner name in the repo SECURITY.md. Schedule a monthly re-read of controls that touch authentication, secrets, and data access. When an agent opens a PR against this area, require dual-user tests and a preview scan before merge. Keep a short incident appendix: which keys to rotate, which dashboards to check, who communicates with users.

Common AI-generator mistakes on vibe-code-scanner (13)

Generators optimize for demos: open data paths, client-trusted roles, missing rate limits, and secrets in env files that ship to browsers. On vibe-code-scanner, re-check those classes after every feature prompt. Search diffs for deleted middleware, new admin routes, and dependency adds. Reject ’temporarily disable auth’ comments without a tracking ticket and expiry.

# smoke verification sketch for vibe-code-scanner
curl -s -o /dev/null -w '%{http_code}\n' "$PREVIEW_URL/healthz"

Verification commands and proofs (14)

Proof beats intention. For vibe-code-scanner, keep a script or checklist that demonstrates deny paths: anonymous access fails, user A cannot read user B, webhooks reject bad signatures, and bundles lack server secrets. Store the last run date next to the checklist. If the date is older than your release cadence, you are flying blind.

// deny-by-default sketch used near vibe-code-scanner
export function assertOwner(userId: string, ownerId: string) {
  if (userId !== ownerId) throw new Error('forbidden');
}

CI and release gates (15)

Encode the minimum bar in CI so humans do not renegotiate under launch pressure: secret scan, dependency audit, unit tests including authz negatives, preview deploy, live security scan failing on criticals. For vibe-code-scanner-related paths, add CODEOWNERS so reviews land on people who understand the threat model.

Environment separation (16)

Production credentials must not appear in previews or local agent sandboxes. Separate projects or branches for data stores, separate OAuth redirect allowlists, and separate Stripe test vs live keys. Document the matrix where coding agents can read it so ‘make preview work’ does not copy prod secrets again.

# smoke verification sketch for vibe-code-scanner
curl -s -o /dev/null -w '%{http_code}\n' "$PREVIEW_URL/healthz"

Related tools and guides

• Token Leak Checker — focused scan for exposed API keys in the frontend bundle.
• Firebase Scanner — Firestore Security Rules, auth, and storage bucket checks.
• Supabase RLS Checker — verify every table has a correct Row Level Security policy.
• Lovable Safety Guide — what Lovable ships insecure by default and how to fix it.
• Is Replit Safe? — public repls, Secrets in forks, and AI-generated endpoints without auth.
• Is Netlify Safe? — build-log leaks, redirect rules, and Functions audit.
• Cursor Security Risks — full Cursor risk profile and hardening checklist.
• Firebase Security Rules: 12 Common Mistakes — rule snippets that fix each mistake.
• Best Burp Suite Alternatives — 9 alternatives compared on features, price, and learning curve.
• Best SAST Tools for AI-Generated Code — Snyk vs Semgrep vs Checkmarx vs VibeEval.
• OWASP Top 10 for AI Code — the canonical failure modes for AI-generated apps.
• Vibe Hacking — how attackers probe vibe-coded apps, so you can think like one.
• Vibe Coding Security Risks — catalogue across tools.