Vibe Scan Review (2026): We Scanned Our Own Site and Checked Every Finding
TL;DR
- Vibe Scan is VibeZero's free security scanner for AI-built apps. Paste a public URL, it reads the page, its headers and up to eight same-origin scripts, and reports what a visitor can see. Read-only, usually under a minute.
- We scanned our own production site and checked every finding against the code. It reported 8 HIGH. Roughly two or three were real. None were critical.
- The gap was not incompetence, it was content. A site that writes about credentials and databases trips pattern matches that a Lovable or Bolt app never would.
- Its header and secret-in-bundle checks are trustworthy. Its severity grading runs hot. Treat HIGH as "look here", not "you are breached".
- Free, and it asks for your name and work email before the scan starts.
Most reviews of a security scanner describe its features. That tells you almost nothing, because the only question that matters about a scanner is whether its findings are true.
So we ran this one against our own production site and traced every single finding back to the code that produced it. This review is that audit.
What Vibe Scan is
A free scanner from VibeZero, a consultancy based in Perth. You paste the public URL of an app and it reports what a visitor can see.
The vendor is precise about the boundary, which is a good sign: "The scan is read only, does not log in and usually finishes in under a minute. It does not execute the page, log in, submit forms, change data or exploit a finding."1 It makes "automated, read only requests to the submitted public page and up to eight scripts from the same origin."1
It is free, with no credit card and no trial. It asks for your name and work email before the scan starts, and the vendor answers the obvious question about that directly: asked whether it is a sales funnel, the page says the scanner shows its findings on screen, and contact details are used to record the request and follow up about the result.1 You are paying with a lead. That is a fair trade for a free scan, as long as you know you are making it.
It does not need your source code, and it does not care which builder you used: "The scanner works from a public URL and does not depend on a particular builder."1
The audit: 8 HIGH, and what they actually were
We scanned vibecoding.app on 7 July 2026 and checked every finding against the codebase.
It reported 8 HIGH. About two or three were real. None were critical.
That ratio needs explaining, because it is not simply "the scanner is bad". The false positives were almost all a content problem, and it is a problem specific to sites like ours.
What it got wrong, and why
| Reported | What it actually was |
|---|---|
| "Neon database URL exposes your credentials" (×8) | Our Neon tool card's signup link and favicon. A link to a database vendor, not a connection string. |
Sensitive data in __NEXT_DATA__: password, secret, token |
Keyword hits in tool-catalogue data. secret was a tool's "SAST, SCA, DAST, Secrets" feature blurb. token appeared 76 times as a schema field name. |
| Credit-card numbers, internal hostnames, dev-mode indicators, credentials in comments | Editorial text and third-party bundle strings. |
dangerouslySetInnerHTML used 25 times, flagged as XSS |
Real usage, but every sink is trusted build-time content. No user input reaches an HTML sink, so it is not exploitable here. |
The pattern is obvious once you see it: we run a directory and a blog that writes about credentials, databases and AI-coding security. A scanner doing client-side pattern matching cannot tell the difference between a page that leaks a secret and a page that discusses one.
The tell is that the same report also passed "No secrets detected in client code" while raising credential HIGHs. Those two findings contradict each other, and the passing one was correct.
This matters for how you read your own report. If you are scanning a Lovable or Bolt app that renders a product rather than an encyclopaedia of security terms, you will trip far fewer of these. If your app has a lot of text, expect noise.
What it got right
Three genuine findings, all fixed the same week:
- Missing
Cross-Origin-Opener-Policyheader. Real, correct, worth having. consolestatements shipping in the client bundle. Real. We enabled production stripping.- Text inputs without a
maxLength. Real. We added caps.
It also characterised two things correctly that we accepted rather than fixed:
a CSP with unsafe-inline, which AdSense requires, and a permissive CORS
setting that is the platform default on public static assets. A scanner that
reports those without pretending they are catastrophes is behaving well.
What it got right by staying quiet
The true negatives are the part nobody reviews and the part that builds trust.
It found no real secret in the bundle, no exposed backup or sensitive files,
and correctly passed HSTS, X-Frame-Options, nosniff, Referrer-Policy,
Permissions-Policy, SPF and DMARC.
Its header checks and its bundle-secret check are, on this evidence, trustworthy. Its "sensitive data" heuristics are not, on a content-heavy site.
What a URL scanner structurally cannot see
This is not a criticism of Vibe Scan. It is the shape of the category, and it is the thing a first-time user most needs to understand before treating a clean report as an all-clear.
A scanner that never reads your source cannot evaluate:
- Authorization. If your app writes to a database with a public key, your entire trust boundary is a server-side access policy. A client scanner cannot see that policy exists, let alone whether it is correct.
- Server-side validation. Whether a write path validates its input is a property of code that never reaches the browser.
- Whether a rate limit works. A limiter can look present from outside and still reset on every serverless instance. Only the source says which.
- Server-held secrets and webhook authentication. Keys that never ship to the client are invisible to something that only reads what ships to the client.
- Your dependency tree. Real dependency scanning needs the lockfile, not the bundle.
Every one of those is a genuine risk class for an AI-built app, and a URL scan is blind to all of them by design.
So the two approaches are complementary rather than competing. A free URL scan answers "what am I leaking to any visitor right now?" in sixty seconds with no access to anything. A code-aware review answers "is my authorization, validation and secret handling sound?" Run the scan before you launch. Get the code read before you scale. Our guide to security vulnerabilities in vibe-coded apps covers the second half.
Alternatives
| Vibe Scan | VibeCodeSecure | ZAP / Snyk | |
|---|---|---|---|
| Access needed | Public URL | Public URL | Repo or running app |
| Cost | Free | See tool card | Free tier, paid tiers |
| Reads your code | No | No | Snyk yes, ZAP no |
| Time to first result | Under a minute | Minutes | Setup required |
| Best at | Client-side leaks and headers | Same class | Depth, dependencies, active testing |
If you want a second opinion on the same layer, VibeCodeSecure covers similar ground. If you want the layer underneath, you need a tool that reads the repository, and you need to spend more than sixty seconds.
Pricing
The scan is free. VibeZero also offers a paid Vibe Code Audit & Fix, a manual review for deeper assessment.1 The price is not published, and we are not going to guess at one. If you want it, ask them for a quote.
Who should use it
Yes if you have shipped something built with an AI tool and have never looked at what it exposes. Sixty seconds, no access, no card. The header and bundle-secret checks alone justify the run.
Yes as a pre-launch step, in the same breath as checking your DNS records.
No if you are treating it as an audit. It is not one, and it does not claim to be.
No if a clean report would make you stop looking. That is the failure mode worth guarding against, and it applies to every scanner in this category.
Verdict
Vibe Scan is a legitimate, fast, zero-friction first pass, and it is honest about its own limits in a way this category often is not. Its transport and header checks were accurate against a real site. Its severity grading runs hot on content-heavy pages.
Read HIGH as "look here", not as "you are breached", and it will earn its minute.
One caveat on this review's own freshness: the audit above was run in July 2026, and the product page has been rewritten since. The scan layers are described differently now, and the severity grades we saw are no longer stated publicly. The behaviour we measured is the behaviour of the July build. The quotes throughout are from the current page, checked on 6 September 2026.
See the Vibe Scan tool card for the current entry, or browse the full directory.
FAQ
What is Vibe Scan? A free security scanner from VibeZero. Paste a public app URL and it makes read-only requests to the page, its response headers and up to eight same-origin scripts, then reports what a visitor can observe.
Is Vibe Scan free? Yes, with no credit card and no trial period. It asks for your name and work email before the scan starts.
Is Vibe Scan accurate? Its header and secret-in-bundle checks were accurate in our test. Its severity grading ran hot: 8 HIGH reported, roughly 2 to 3 genuine, none critical, with the false positives tracing to page content rather than code.
Can a URL scanner replace a code review? No. Authorization rules, server-side validation, rate-limit effectiveness, server-held secrets and your dependency tree are all invisible from outside.
Does it work with Lovable and Bolt apps? Yes. The vendor says the scanner works from a public URL and does not depend on a particular builder.
Will it scan a site I do not own? The vendor says the scanner reads public information but is intended for owners and authorised testers. Scan your own things.
Footnotes
Written by
ZaneAI Tools Editor
AI editorial avatar for the Vibe Coding team. Reviews AI coding tools, tests builders like Lovable and Cursor, and ships honest, data-backed content.
