vibe eval - ai security testing for vibe-coded apps
About Vibe Eval
AI-powered dynamic security testing for vibe-coded web apps. Paste a deployed URL and autonomous agents probe it like an attacker would, checking for missing Supabase/Firebase RLS, exposed API keys, auth bypasses, broken CORS, open storage buckets, and IDOR. Findings ship with a captured exploit and reproducible proof of concept, plus fix prompts ready for Claude Code, Cursor, or Lovable.
Key Capabilities
Scans deployed URLs directly, no source code access needed
310+ security probes tuned to AI-generated app patterns
Findings include a captured exploit and reproducible PoC
Fix prompts formatted for Claude Code, Cursor, and Lovable
Daily re-scans catch regressions as you keep shipping
Free single-purpose tools like Token Leak Checker and Supabase RLS Probe
Standout Features
Attacker-Style Probing
Agents map your app's routes and attack them with 310+ probes, proving exploits in a sandbox.
Proof-Based Findings
Each finding ships with the captured request, response, and a reproducible proof of concept.
AI Fix Prompts
Findings convert to fix prompts formatted for Claude Code, Cursor, and Lovable.
Daily Re-Scans
Scheduled scans re-test your app every day to catch regressions between releases.
Perfect for
Compare Vibe Eval
Community Buzz
Community Buzz
No recent posts yet
We are monitoring X for fresh discussions about Vibe Eval.
Similar Tools to Vibe Eval
Jotform AI App Builder
No-code AI app builder from Jotform that turns a prompt, file, URL, screenshot, or voice note into a working web and mobile app with pages, navigation, forms, workflows, and dashboards. Built on Jotform's form and data components, so it is strongest for form-heavy internal tools, client portals, and data-driven apps. Free to use, with form, submission, and user limits set by your underlying Jotform plan.
Retool
Low-code platform for building internal tools, admin panels, and dashboards. Retool combines 90+ drag-and-drop UI components with JavaScript extensibility and AI app generation to connect any database or API.
Hermes WebUI
Lightweight dark-themed browser interface for Hermes Agent with full parity to the CLI. Three-panel layout with sessions sidebar, chat, and workspace file browser. Community project that runs against any existing Hermes install.
Atoms
AI employees that validate ideas, build products, and acquire customers in minutes, without coding. A multi-agent crew runs research, planning, full-stack build (frontend, backend, database, auth, Stripe), deployment via Atoms Cloud, and post-launch growth with built-in SEO and ads agents. Designed for founders who want a faster path from idea to a launchable product, not just another prototype generator.
Vibe Scan
Free, no-login web scanner for vibe-coded apps, built by VibeZero, a Perth AI consultancy. Paste a live URL and it runs a read-only scan across six layers: transport and headers, exposed secrets, auth and access control, third-party surface, data exposure, and platform fingerprints. Most scans finish in 5 to 15 seconds. It fingerprints apps built on Lovable, Bolt.new, Cursor, Claude Code, Replit, Windsurf, v0, and Base44, then returns a graded plain-English report. It reads only what the site serves publicly: it does not log in, submit forms, or send attack payloads. The deeper Vibe Code Audit & Fix is a paid human engagement from the same firm, quoted per project rather than sold as a product. Name collision worth knowing: this scanner lives at vibe0.com.au and has nothing to do with either product called VibeKit. Superagent's July 2025 open-source v0 clone was also called vibe0; that name has since been retired and the project is simply VibeKit, now dormant, at /tools/vibekit. Separately, the mobile AI app builder at vibekit.bot shares that name too and is unrelated to both: see /tools/vibekit-bot.
VibeKit
Looking for the open-source agent sandbox on GitHub? That is a different product: see VibeKit by Superagent at /tools/vibekit. This page covers vibekit.bot. Mobile-first AI app builder where every app you create gets its own persistent AI agent, a real GitHub repo under your account, and a live URL at yourapp.vibekit.bot. Describe what you want and the agent builds it, deploys it to a managed container, then keeps working: health checks every 60 seconds, auto-diagnosis and redeploy when something breaks, and AI QA that browses the live app and files bug reports. The agent runs server-side, so the iOS app is a remote control rather than the thing doing the work, and closing your phone does not stop a run. Drive it from the iOS app, the web dashboard, a CLI, a REST API, or an MCP server. Pricing is BYOK-first: connect your own Anthropic or OpenAI key and the agent bills that provider at standard rates with no platform margin. Without a key, requests route through OpenRouter against a credit balance at a platform markup the privacy policy puts at 20 percent, with OpenRouter's data-discount setting enabled on that path only; a free model option keeps building at $0, and the free tier runs $0.50 a session past its first ten. Built and run by one person, Brian Boisjoli, and actively shipping. There is no enterprise tier, no published SOC 2 or SSO, and no Android app.
ready to try vibe eval?
go to the official site and judge Vibe Eval yourself.
try vibe eval now