Question 1

What is a "Security Sanity Check for AI-Generated Apps"?

Accepted Answer

AI coding tools like Cursor, Lovable, and Bolt ship apps fast but often skip security fundamentals — exposed API keys, missing rate limiting, no HTTPS headers, public debug routes. This tool runs a rapid automated check of all the common mistakes and gives you a prioritized fix list with AI prompts to fix each one.

Question 2

What does this scanner actually check?

Accepted Answer

Two layers: (1) Client-side HTML/JS analysis — 23 secret patterns, dangerous JS, cookie flags, SRI hashes, library CVEs. (2) Server-side checks — HTTP response headers (HSTS, CSP, X-Frame-Options), infrastructure file exposure (/.env, /.git), open debug routes (/api/debug), CORS configuration, rate limiting, robots.txt, sitemap, and server technology leakage.

Question 3

What are the AI Fix Prompts?

Accepted Answer

Every finding has a "Copy AI Fix Prompt" button. The prompt is a detailed technical instruction you paste directly into Cursor, Lovable, ChatGPT, Claude, or any AI tool. It tells the AI exactly what vulnerability exists, why it matters, and what code changes to make — no security knowledge needed.

Question 4

Why does it check /.env and /.git?

Accepted Answer

These are catastrophic mistakes that happen more often than you think, especially with AI-generated apps. An exposed /.env gives an attacker every API key and credential in your app. An exposed /.git lets them download your entire source code including secrets in old commits. A single HEAD request detects both in milliseconds.

Question 5

What is CORS wildcard and why is it dangerous?

Accepted Answer

Access-Control-Allow-Origin: * means any website on the internet can make API requests to your backend and read the responses. This is fine for truly public APIs, but if your API handles user data, authentication, or paid AI calls, a wildcard CORS policy lets other sites abuse it on behalf of your users.

Question 6

Why check for rate limiting?

Accepted Answer

AI-generated apps almost never implement rate limiting. If your app calls OpenAI, Stripe, or any paid API without rate limits, a malicious user can hammer your endpoints and cost you hundreds of dollars in minutes. Rate limiting is the single most overlooked security issue in vibe-coded apps.

Question 7

Can this replace a professional security audit?

Accepted Answer

No. This is a passive sanity check — it catches the obvious, catastrophic mistakes that are common in AI-generated apps. It cannot test authenticated endpoints, find business logic flaws, or run active exploits. Think of it as the security check you do before showing your app to anyone.

Question 8

Is any data stored?

Accepted Answer

No. Client-side analysis runs in your browser. The server-side scan fetches only HTTP headers and probes specific paths — no page content is stored. Scan history lives in your browser localStorage only.

Is Your Vibe-Coded App
Actually Secure?

Built for AI-Generated Apps

10-Second Full Scan

AI Fix Prompts Included

What gets checked

Secrets & Credentials

Infrastructure Exposure

Code & API Risks

Headers & Dependencies

Secure Cloud Hosting

Launch securely in 3 steps

Frequently asked questions

Is Your Vibe-Coded AppActually Secure?