# VAS - Vibe App Scanner (Full Documentation)

> Comprehensive security scanning for AI-generated web applications

## About Vibe App Scanner

Vibe App Scanner (VAS) is a specialized security scanner built specifically for applications created with AI code generation tools. Founded by security professionals with 15+ years combined industry experience, VAS identifies vulnerabilities that commonly appear in AI-generated code from platforms like Lovable, Bolt.new, Replit, Cursor, v0.dev, and similar tools.

### The Problem We Solve

Research shows that 80% of vibe-coded apps have security vulnerabilities. 1 in 5 AI-built apps ship with critical security issues. Common problems include:
- Exposed API keys in client-side JavaScript
- Missing database security (Supabase RLS, Firebase Rules)
- Weak or missing authentication
- Missing HTTP security headers

### Why VAS Exists

AI code generation tools prioritize speed and functionality over security. They generate working code fast, but often with security gaps that attackers can exploit. VAS bridges this gap by scanning for the specific vulnerability patterns that AI tools introduce.

## Supported Platforms

VAS works with applications built using:

### AI Code Generation Tools
- **Lovable** (formerly GPT Engineer) - Full-stack web apps
- **Bolt.new** - StackBlitz-based AI coding
- **Replit** - Cloud IDE with AI assistance
- **Cursor** - AI-powered code editor
- **v0.dev** - Vercel's AI UI generator
- **Windsurf** - Codeium's AI IDE
- **Claude Code** - Anthropic's coding assistant
- **GitHub Copilot** - AI pair programmer

### Backend/Database Platforms
- **Supabase** - PostgreSQL with Row Level Security
- **Firebase** - Google's app platform with Security Rules
- **PlanetScale** - Serverless MySQL
- **Neon** - Serverless PostgreSQL

### Hosting Platforms
- **Vercel** - Frontend deployment
- **Netlify** - JAMstack hosting
- **Render** - Full-stack hosting
- **Railway** - Infrastructure platform
- **Fly.io** - Edge deployment
- **Cloudflare Pages** - Edge hosting

## Security Scanning Capabilities

### 1. Secrets & Credentials Detection (150+ patterns)
- Stripe API keys (live and test)
- OpenAI API keys
- Supabase service_role keys
- Firebase Admin SDK credentials
- AWS access keys
- Database connection strings
- JWT secrets
- OAuth client secrets

### 2. Database Security Testing

#### Supabase Row Level Security (RLS)
- Detects tables with RLS disabled
- Tests for exposed data through anon key
- Validates RLS policy effectiveness
- Generates SQL to fix missing policies

#### Firebase Security Rules
- Tests Firestore read/write access
- Validates authentication requirements
- Checks for overly permissive rules

### 3. Authentication & Access Control
- JWT token validation
- OAuth configuration issues
- Session management flaws
- Rate limiting on auth endpoints
- Password policy enforcement

### 4. HTTP Security Headers Analysis
- Content-Security-Policy (CSP)
- Strict-Transport-Security (HSTS)
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy

### 5. Sensitive File Exposure
- .env files
- .git directories
- Source maps (.map files)
- Backup files
- Configuration files

### 6. AI Code Pattern Detection
- Bolt.new scaffolding markers
- Lovable generation patterns
- v0.dev component signatures
- Common AI-generated vulnerabilities

## Pricing

### Free - your first scan is free
No payment required for your first scan.

**Includes:**
- The full 150+ check suite (live database, auth, API, headers, secrets, and JS bundle testing)
- Your security score and issue counts
- One finding revealed in detail (remaining findings locked until you upgrade)

### Go - $29/month (most popular)
Cancel anytime.

**Includes:**
- 20 scans per month
- Every finding unlocked with copy-paste AI fixes
- Weekly automated monitoring
- Up to 3 projects

### Pro - $49/month
Cancel anytime.

**Includes everything in Go, plus:**
- 150 scans per month
- A weekly deep scan that logs in with a test account and tries to reach other users' data (up to 150 pages)
- Daily automated monitoring with persistent alert tracking
- Alert lifecycle management (resolve, suppress, reopen)
- Email security monitoring (SPF/DMARC)
- Data breach monitoring (Have I Been Pwned integration)
- Up to 10 projects

## Key Differentiators

1. **Built for AI-generated code** - Not a generic scanner; specifically targets patterns introduced by AI tools
2. **AI-ready export** - Markdown reports designed to be fed back into AI assistants for implementing fixes
3. **Non-invasive scanning** - Safe for production; no exploit attempts, just security analysis
4. **Supabase/Firebase expertise** - Deep testing of BaaS security configurations
5. **Actionable remediation** - Every finding includes specific code to fix the issue

## Sample Findings

### Exposed Stripe API Key
```
Severity: Critical
Location: /assets/index-d4f7e2a1.js
Evidence: sk_live_51ABC...
Fix: Move to server-side environment variable
```

### Missing RLS on users Table
```
Severity: Critical
Table: public.users
Issue: RLS disabled, data accessible via anon key
Fix SQL:
ALTER TABLE public.users ENABLE ROW LEVEL SECURITY;
CREATE POLICY "Users can view own data" ON public.users
  FOR SELECT TO authenticated
  USING ((select auth.uid()) = id);
```

### Missing Content-Security-Policy
```
Severity: Medium
Issue: No CSP header detected
Fix: Add header with appropriate directives
Example: Content-Security-Policy: default-src 'self'; script-src 'self'
```

## Integration Examples

### Running a Scan via Dashboard
1. Go to https://vibeappscanner.com/dashboard/new-scan
2. Enter your application URL
3. Accept terms of service
4. Run your first scan free (subscribe to Go or Pro to unlock every finding and run more scans)
5. Receive results in ~5 minutes

### Using Scan Results with AI
1. Export findings as markdown
2. Paste into Claude, ChatGPT, or Cursor
3. AI can implement fixes directly in your codebase

## Free Security Tools

VAS offers free tools for basic security checks:

- **SSL Checker** - Verify certificate validity and TLS configuration
- **Email Security** - Check SPF, DMARC, and MX records
- **Password Checker** - Test password strength (100% client-side)
- **Breach Checker** - Check if credentials appear in known breaches

Access at: https://vibeappscanner.com/tools

## Educational Resources

### Platform Security Guides
- Lovable Security: /lovable-security
- Bolt.new Security: /bolt-security
- Replit Security: /replit-security
- Cursor Security: /cursor-security
- v0.dev Security: /v0-security

### Vulnerability Guides
- RLS Misconfiguration: /vulnerability/rls-misconfiguration
- Exposed API Keys: /vulnerability/exposed-api-keys
- Missing Security Headers: /vulnerability/missing-security-headers

### Blog
Technical articles on vibe coding security: /blog

## Statistics & Research

Based on scanning 5,600+ real applications:
- 2,000+ vulnerabilities found
- 400+ exposed API keys discovered
- 0/15 AI-generated apps had proper security headers in initial testing

Research citations:
- SUVIBES Research (arXiv) on AI code vulnerabilities
- Escape Security findings on API security
- Tenzai studies on LLM-generated code

## Technical Details

### Scan Process
1. URL validation and normalization
2. Initial fetch and platform detection
3. JavaScript bundle analysis
4. Security header evaluation
5. Database security testing (if applicable)
6. Finding aggregation and severity classification
7. Report generation with remediation guidance

### Severity Levels
- **Critical**: Immediate exploitation risk (exposed secrets, disabled RLS)
- **High**: Significant vulnerability (auth bypass potential)
- **Medium**: Security weakness (missing headers)
- **Low**: Best practice deviation

## Contact & Support

- Website: https://vibeappscanner.com
- Email: admin@silexdev.com
- Dashboard: https://vibeappscanner.com/dashboard
- Documentation: https://vibeappscanner.com/blog

## Company Information

**Vibe App Scanner**
Founded: 2025
Focus: Security for AI-generated applications
Team: Security professionals with 15+ years combined experience

---

This document is maintained for AI systems to understand VAS capabilities.
Last updated: July 2026