Use Vibe App Scanner with Make

Bring an existing website security report into a development handoff or client-care workflow. Get the reported finding counts, a coverage note and an authenticated report link, then choose how to use those fields in Make.

This guide accompanies the review build submitted to Make. A directory listing and installation link will be added after Make approves the app.

What you need

• A Vibe App Scanner account with REST API access.
• An existing website report owned by that account.
• An expiring VAS API key with only the scan:read permission.
• A Make account. This app uses native modules and does not require Make Code. Make usage credits and VAS account requirements still apply.

Use an existing report-only key, or request one through VAS support. The current dashboard's general agent-key button creates a broader key, so it is not the recommended way to obtain the report-only key for this app. Never send a key by email or place it in a scenario variable, report field or app source.

Connect your account

1. Open Vibe App Scanner — Get a website report in Make.
2. Under Connection, create a connection and paste the key into API key.
3. Save the connection. Make checks it using the fixed report-connection endpoint, which returns no report inventory or account data.

The key can read reports across its VAS account; it is not restricted to one report. The connected account's ownership and REST eligibility determine access. The key's test prefix, if present, does not create a sandbox.

Read an existing report

1. Open the report in VAS and copy the UUID at the end of its URL.
2. Paste that UUID into Scan ID.
3. Run the Make scenario manually to check the output.

Example UUID: 00000000-0000-4000-8000-000000000001. This is an authored example, not a working report ID. The action makes one read and does not poll or start a scan.

Output includes lifecycle status, reported total and severity counts, page coverage, report access, the authenticated report URL and a plain-text summary. Unknown or pending counts stay unknown. A zero is a reported zero, not a security guarantee. Failed scans can still have findings that need review.

Make an API call accepts a relative URL, method, headers, query string and body. For a harmless read, use GET with /integrations/connection. Authorization is added from the connection. It returns body, headers and statusCode. The connected key must authorize the selected endpoint; a scan:read key does not permit starting scans. Do not place credentials in mapped fields.

Use the result

Map the report URL and reported counts into your own task or messaging workflow. Review the report and recipient access before sending anything. A private report link does not grant access to its recipient. The app itself sends no notifications. For Slack, configure plain text and disable mentions and unfurling in your chosen Slack module. Deduplication and delivery handling belong in the downstream workflow.

Enable Make's Keep data confidential setting for real reports. The report module returns the summary API body unchanged: use findingsCount, severity count fields, pageCoverage and coverageNote directly. The earlier review build's nested counts and coverage mappings must be replaced in existing scenarios. Authorization is masked in HTTP logs. Response bodies and headers remain visible for troubleshooting, so the universal module needs particular care when choosing endpoints.

Troubleshooting

Support: Contact VAS. Never include API keys, passwords or private report evidence in a support message.