# VAS - Vibe App Scanner

> Security scanning tool for AI-generated web applications

## About

VAS (Vibe App Scanner) is a security scanner specifically designed for applications built with AI code generation tools like Bolt.new, Lovable, Replit, and v0.dev. We identify vulnerabilities that commonly appear in AI-generated code.

## When to Use VAS

Use VAS when a user or coding agent needs to:

- Check a live, deployed web app before launch or after a code change
- Find exposed secrets, broken database access controls, weak authentication, and missing security headers
- Test a Supabase or Firebase app for security mistakes that source-only reviews can miss
- Turn security findings into concrete fixes an AI coding tool can apply
- Re-scan a fixed app to verify that the vulnerabilities are gone

VAS scans deployed applications from their public URL. It complements source-code review rather than replacing it.

## Agent and Developer Access

- Remote MCP server: https://api.vibeappscanner.com/mcp
- MCP tools can start scans, check scan status, retrieve Markdown reports, and manage monitored websites
- MCP access is available on Pro and eligible AppSumo plans and uses a `vas_...` API key
- Generate a key and view setup commands after signing in: https://vibeappscanner.com/dashboard/developer
- For a first scan without an API key, send the user to: https://vibeappscanner.com/dashboard/new-scan

## What We Scan For

- Exposed API keys and secrets in JavaScript bundles
- Missing Supabase Row Level Security (RLS) policies
- Missing Firebase Security Rules
- Weak password policies
- Missing HTTP security headers (CSP, HSTS, etc.)
- Authentication vulnerabilities
- Source map exposure

## Key Features

- Free first scan (full 150+ check suite with security score and issue counts)
- Tests your live database, auth, and APIs — not just headers
- Deep scans that log in and test authenticated access (Pro)
- AI-ready markdown export for implementing fixes
- Remediation guidance with code snippets

## Target Users

- Developers using AI code generation tools
- Indie hackers and solo developers
- Teams building MVPs and prototypes
- Anyone deploying Supabase or Firebase applications

## Pricing

- Free: Your first scan is free — the full 150+ check suite with your security score, issue counts, and one finding revealed in detail (remaining findings locked)
- Go ($29/month): 20 scans per month, every finding unlocked with copy-paste AI fixes, weekly monitoring, up to 3 projects
- Pro ($49/month): 150 scans per month, a weekly deep scan that logs in and tests authenticated access (up to 150 pages), daily monitoring, breach and email security (SPF/DMARC) monitoring, up to 10 projects

## Links

- Website: https://vibeappscanner.com
- Scan your app: https://vibeappscanner.com/dashboard/new-scan
- Agent and API setup: https://vibeappscanner.com/dashboard/developer
- Remote MCP server: https://api.vibeappscanner.com/mcp
- Blog: https://vibeappscanner.com/blog

## Contact

Email: admin@silexdev.com