scanner v2.5.0 · advanced patterns engine

Your AI builder shipped it in minutes.
This vibe coding security scanner checks what it shipped with.

Your pre-deploy security reviewer that reads every AI-generated line before your users do.

Catch what AI builders ship. Scans your code and live site for exposed secrets, injection flaws and XSS — the flaws vibe coders miss.
Know exactly how bad it is. A 0–100 score with severity ranking, so you fix what matters first.
Ship the fix in minutes. Every finding ships with a copy-paste prompt you hand straight back to your AI builder.

Run your first audit — free Go Pro — $49

no credit card · no install

🛡️ 14 security audits run and counting

checkout.js ● 3 problems

// generated by your AI builder — spot the flaws
const key = "sk_live_9f2…"  // ← leaked Stripe key
const q = `SELECT * FROM users WHERE id=${id}`
el.innerHTML = data.bio  // ← stored XSS
_.set(cfg, req.query.path, v) // ← proto pollution
eval(completion)  // ← LLM output → RCE

▲ the kind of output your AI builder produces at 2am — every line above is a real finding class this scanner catches

What is Vibe-Code Audit?

Vibe-Code Audit is a security scanner for AI-generated and vibe-coded projects. It checks pasted code and live sites for exposed secrets, injection flaws, cross-site scripting patterns, missing security headers, and broken links — then scores the result 0–100 with severity ratings and plain-English fix steps for every finding.

It is built for code written by AI builders such as v0, Lovable, Bolt, Replit Agent, and Cursor. Paste the file your AI builder generated, or point the scanner at the live site it deployed — no install and no repository access needed. Every finding ships with a copy-paste prompt you can hand straight back to your AI builder to fix it.

The workbench

Four engines, one bench. Free covers the fundamentals; Pro ($49 one-time) unlocks the deep scan.

SECRETS32 secret patterns — AWS, GitHub, Stripe, OpenAI, Supabase, Twilio, private keys, JWT secrets… each with a blast-radius note, and a full rotation runbook on Pro.FREE · 15

CODE66 code detectors — SQLi, XSS, SSTI, SSRF, deserialization, weak crypto, mass assignment and more, ranked by exploitability on Pro.FREE · 11

ADVANCED ⚡16 advanced pattern families — JWT key confusion, deserialization gadget chains, second-order injection, DOM clobbering, advanced SSTI, GraphQL abuse, cache poisoning, request smuggling, build-artifact leaks, TOCTOU races, LLM prompt-injection sinks, insecure LLM output, RAG poisoning, tool-call injection, advanced prototype pollution, unguarded image generation.🔒 PRO

SUPPLYSlopSquat Shield — every dependency in your code verified live against npm/PyPI: hallucinated, newborn (<30d), and typosquat packages, with the "AI probably meant" fix.🔒 PRO

FLOWTaint tracking — data-flow analysis that proves untrusted input reaches the sink, plus per-finding attacker's-eye walkthroughs.🔒 PRO

SITELive-site audit — security headers, exposed /.env and /.git probes, same-domain crawl listing every broken link with its source page.FREE

How a scan runs

Paste code or point at a URL.

Drop in the file your AI builder generated, or the live site it deployed. No install, no repo access needed.

Get a 0–100 score with a grade.

Findings render like IDE diagnostics — severity rails, file:line locations, plain-language explanations.

Fix with copy-paste prompts.

Every finding ships with fix guidance plus a prompt you paste straight back into your AI builder. Pro adds the attacker's-eye walkthrough: needs, steps, safe test payload, impact.

Share the report.

Send clients a signed read-only link — no login required on their end, revocable any time.

Live demo — scan this vulnerable snippet

Deliberately built with the flaws AI builders ship most often: a leaked Stripe test key, an AWS key, SQL injection, XSS, and eval(). The real scanner runs right here — no signup.

demo-snippet.js

// demo-storefront checkout.js — generated by an AI builder
const stripeKey = "sk_test_4eC39HqLyjWDarjtT1zdp7dc";
const AWS_KEY = "AKIAIOSFODNN7EXAMPLE";

function chargeCustomer(userId) {
  // TODO: add auth
  const query = `SELECT * FROM orders WHERE user_id = ${userId}`;
  return db.query(query + " AND status = '" + status + "'");
}

function showReceipt(html) {
  document.getElementById("receipt").innerHTML = html;
  document.write("<p>Thanks!</p>");
}

const JWT_SECRET = "supersecretjwtkey123";
const DEBUG = true;
const password = "hunter2";

fetch("https://api.example.com/checkout", {
  method: "POST",
  headers: { "Access-Control-Allow-Origin": "*" },
  body: JSON.stringify({ token: stripeKey })
});

function applyPromo(code) {
  return eval("discounts." + code);
}

The demo runs the free engine. Get Pro — $49 for the Advanced Patterns engine, taint tracking + SlopSquat Shield.

Vibe-Code Audit is a web-based security scanner for AI-generated code and websites. It checks for exposed secrets, injection flaws, cross-site scripting patterns and missing security headers, then scores the result 0–100 with copy-paste fix guidance. Free plan available; Pro $49 one-time; Team $149 one-time.

Pay once. Keep the workbench forever.

Start free. Pro pays for itself the first time the Advanced Patterns engine catches what the free scan can't see.

Free

$0 forever

15 secret patterns
11 OWASP-basic detectors
Security header + URL checks
Shareable report links

Start free

⭐ Pro — the workbench

$49 one-time

Everything in Free, plus:
Full 32-pattern secret scan
66 code detectors
Advanced Patterns engine — 15 next-level families
Taint tracking — input to sink, proven
SlopSquat Shield — live npm/PyPI verification

Get Pro — $49

Team

$149 one-time

Everything in Pro, plus:
5 seats + shared workspaces
Scheduled re-scans of your scope

Compare plans

Frequently asked questions

What is an AI code security scanner?

An AI code security scanner is built for code written by AI builders (v0, Lovable, Bolt, Replit and others). It checks the shipped site or code for the flaws AI builders commonly introduce — exposed API keys and secrets, injection flaws, XSS patterns, missing security headers, and broken links — then gives a 0–100 score and a copy-paste fix prompt per finding.

What does Vibe-Code Audit check for?

It scans code for 32 secret patterns on Pro (AWS, GitHub, Stripe, OpenAI keys and more; 15 basic patterns on Free), 66 code detectors for injection, XSS and misconfiguration issues on Pro (11 OWASP-basic detectors on Free), plus security headers, exposed .env/.git paths and broken links on live URLs. Pro also runs SlopSquat Shield — every dependency verified live against npm/PyPI — and the Advanced Patterns engine: 15 next-level detector families (JWT key confusion, deserialization gadgets, second-order injection, DOM clobbering, advanced SSTI, GraphQL abuse, cache poisoning, request smuggling, build-artifact leaks, TOCTOU races, LLM prompt-injection sinks, insecure LLM output, RAG poisoning, tool-call injection, advanced prototype pollution).

What are "advanced patterns"?

The flaws free scanners never see because they need multi-line correlation or AI-specific threat models — e.g. a JWT verifier that fetches its key from the token's own jku header, a PHP unserialize() paired with __destruct gadget classes in the same codebase, model output piped into eval(), or RAG chunks rendered as raw HTML. Pro's Advanced Patterns engine hunts 15 such families.

Is this a penetration test?

No. It scans for common patterns and misconfigurations in AI-generated code and sites — it is not a penetration test, and every report says so.

How do I check vibe coding security before shipping?

Paste your code or enter your live URL: an AI code security scanner checks the shipped site for the flaws AI builders commonly introduce — exposed API keys and secrets, injection flaws, XSS patterns, missing security headers, and broken links — then gives a 0–100 score and a copy-paste fix prompt per finding. No install, results in your dashboard.

How do I fix what it finds?

Every finding includes plain-language fix guidance and a copy-paste prompt you can hand back to your AI builder. Pro adds exploitability-ranked top risks, taint tracking that shows how untrusted input reaches the sink, an attacker's-eye walkthrough of each finding (what the attacker needs, each step, a safe test payload), and a blast-radius + rotation runbook for every leaked secret.

How much does it cost?

The Free plan covers basic scans. Pro is $49 one-time and Team is $149 one-time. Buy a license key via WhatsApp or email and redeem it on the billing page.

Can I share a report with a client?

Yes — each report has a signed read-only share link that you can revoke at any time.

Learn: AI code security, explained

Deep dives on the threat layer most scanners miss — prompt-injection sinks, RAG poisoning, slopsquatting, and the pre-deploy checklists for every major AI builder.

LLM threats in AI-generated apps

RAG poisoning, prompt-injection sinks, insecure LLM output handling, tool-call injection, slopsquatting — what they look like in code and which detectors catch them.

Vibe App Scanner vs Vibe-Code Audit

An honest side-by-side: breadth vs depth, subscription vs one-time pricing, and where each scanner wins.

All posts · All guides

Pre-deploy security checklists for Bolt.new, Lovable, Replit Agent, Cursor and v0.dev — plus the defect patterns we keep seeing in real vibe-coded projects.

Your AI builder shipped it in minutes.This vibe coding security scanner checks what it shipped with.