vibe scan by vibezero - security scanner for ai-built apps
About Vibe Scan
Free, no-login web scanner for vibe-coded apps, built by VibeZero, a Perth AI consultancy. Paste a live URL and it runs a read-only scan across six layers: transport and headers, exposed secrets, auth and access control, third-party surface, data exposure, and platform fingerprints. Most scans finish in 5 to 15 seconds. It fingerprints apps built on Lovable, Bolt.new, Cursor, Claude Code, Replit, Windsurf, v0, and Base44, then returns a graded plain-English report. It reads only what the site serves publicly: it does not log in, submit forms, or send attack payloads. The deeper Vibe Code Audit & Fix is a paid human engagement from the same firm, quoted per project rather than sold as a product.
Name collision worth knowing: this scanner lives at vibe0.com.au and has nothing to do with either product called VibeKit. Superagent's July 2025 open-source v0 clone was also called vibe0; that name has since been retired and the project is simply VibeKit, now dormant, at /tools/vibekit. Separately, the mobile AI app builder at vibekit.bot shares that name too and is unrelated to both: see /tools/vibekit-bot.
Key Capabilities
Read-only scan of a live URL, no login or code access needed
Six-layer check: headers, secrets, auth, third-party, data exposure, platform fingerprints
Graded report: Fix now, Fix this week, Needs a human
Fingerprints Lovable, Bolt.new, Cursor, Replit, v0, and Base44 defaults
Surface-level triage only: no authenticated probing or attack payloads
Standout Features
Transport & Headers
Checks HTTPS, HSTS, and security headers on the live response.
Exposed Secrets
Scans the client bundle for keys and tokens anyone can read.
Auth & Access Control
Flags open routes and weak access defaults from AI scaffolds.
Platform Fingerprints
Detects Lovable, Bolt, Replit, Base44, and v0 default weaknesses.
Perfect for
Compare Vibe Scan
Community Buzz
Community Buzz
No recent posts yet
We are monitoring X for fresh discussions about Vibe Scan.
Similar Tools to Vibe Scan
Jotform AI App Builder
No-code AI app builder from Jotform that turns a prompt, file, URL, screenshot, or voice note into a working web and mobile app with pages, navigation, forms, workflows, and dashboards. Built on Jotform's form and data components, so it is strongest for form-heavy internal tools, client portals, and data-driven apps. Free to use, with form, submission, and user limits set by your underlying Jotform plan.
AppWizzy
Flatlogic Generator, renamed AppWizzy: an AI builder for business apps such as CRMs, ERPs and admin panels that hands you the full source code to host and extend yourself.
Retool
Low-code platform for building internal tools, admin panels, and dashboards. Retool combines 90+ drag-and-drop UI components with JavaScript extensibility and AI app generation to connect any database or API.
Hermes WebUI
Lightweight dark-themed browser interface for Hermes Agent with full parity to the CLI. Three-panel layout with sessions sidebar, chat, and workspace file browser. Community project that runs against any existing Hermes install.
Atoms
AI employees that validate ideas, build products, and acquire customers in minutes, without coding. A multi-agent crew runs research, planning, full-stack build (frontend, backend, database, auth, Stripe), deployment via Atoms Cloud, and post-launch growth with built-in SEO and ads agents. Designed for founders who want a faster path from idea to a launchable product, not just another prototype generator.
VibeKit
Looking for the open-source agent sandbox on GitHub? That is a different product: see VibeKit by Superagent at /tools/vibekit. This page covers vibekit.bot. Mobile-first AI app builder where every app you create gets its own persistent AI agent, a real GitHub repo under your account, and a live URL at yourapp.vibekit.bot. Describe what you want and the agent builds it, deploys it to a managed container, then keeps working: health checks every 60 seconds, auto-diagnosis and redeploy when something breaks, and AI QA that browses the live app and files bug reports. The agent runs server-side, so the iOS app is a remote control rather than the thing doing the work, and closing your phone does not stop a run. Drive it from the iOS app, the web dashboard, a CLI, a REST API, or an MCP server. Pricing is BYOK-first: connect your own Anthropic or OpenAI key and the agent bills that provider at standard rates with no platform margin. Without a key, requests route through OpenRouter against a credit balance at a platform markup the privacy policy puts at 20 percent, with OpenRouter's data-discount setting enabled on that path only; a free model option keeps building at $0, and the free tier runs $0.50 a session past its first ten. Built and run by one person, Brian Boisjoli, and actively shipping. There is no enterprise tier, no published SOC 2 or SSO, and no Android app.
Related Articles
ready to try vibe scan?
go to the official site and judge Vibe Scan yourself.
try vibe scan now