Hey Sumo-lings,

One request that kept coming up was: “Can VAS check my code as well as my live website?”

You can now connect a GitHub repository or upload a ZIP and run a source-code security scan. Repository scanning is available in beta for AppSumo Tier 2 and Tier 3 accounts, included within your plan’s allowances.

Website scanning and repository scanning look at different parts of your app. This gives you another way to investigate potential issues in your code, dependencies and configuration, with file and line references and guidance you can take back to your coding tool.

We’ve also just added:

• Saved accepted-risk and false-positive decisions for supported findings when the evidence and repository scope remain unchanged.

• Recognition of supported native scanner suppression markers, while retaining the original findings for transparency.

• A separate section for acknowledged findings, so your decisions don’t get lost in the report.

This is still a beta. Coverage varies by language, framework and repository size. Some checks or AI reviews may be incomplete, and a clean report is not a guarantee that an application is secure.

I’m working closely with early users and using their feedback to improve reliability, coverage and the reporting experience. If something looks wrong, feels confusing or is missing from your workflow, I’d genuinely like to hear about it.

Tier 2 and Tier 3 users can find Repository scans in their dashboard now.

Give it a try and let me know what you’d like us to improve next.

Thanks for helping shape VAS.

Jacob
Co-founder, Vibe App Scanner

Hey Sumo-lings 👋

We’re the two founders behind Vibe App Scanner, and between us we’ve spent almost two decades working in cybersecurity.

Before VAS, we were doing code and security audits through our agency. More and more of the apps landing in front of us were built with tools like Lovable, Base44, Replit, Claude, Codex, etc.

A lot of them looked great. They worked. They were ready to show customers.

Then we looked under the hood.

We kept finding the same problems: Supabase tables anyone could read, service-role keys sitting in frontend code, APIs that trusted whatever user ID they were given, and authentication that stopped at “is this person logged in?” without checking what they should actually be allowed to access.

The founders building these apps weren’t careless. The tools had helped them ship quickly, but checking the security still required knowledge most founders understandably don’t have.

We built Vibe App Scanner to make that part much easier.

Paste in the URL of your live app, and VAS checks what is actually exposed. It goes beyond the usual security header checklist to inspect your JavaScript, discover APIs, test database access controls, check authentication, and look for the mistakes we saw during real audits.

It also understands the stacks AI-built apps commonly use. For example, a Supabase anon key is meant to be public. A Supabase service-role key absolutely is not. That distinction sounds simple, but plenty of generic scanners get it wrong.

The bit we’re proudest of is what happens after VAS finds something.

You don’t just get a scary vulnerability name and a link to a technical article. You get the evidence, an explanation you can understand, and a copy-paste fix you can hand straight to Lovable, Cursor, Claude Code or your developer.

Fix it, scan again and check that it’s really gone.

VAS also checks performance, accessibility, SEO, compliance, email security and AI search visibility, so you get a much better idea of whether your app is ready to launch, not just whether the homepage looks finished.

We’re bringing VAS to AppSumo because we know how much this community builds and ships. We also know that most small teams don’t have a security engineer sitting beside them every time they push an update.

We’ll be here throughout the campaign to answer questions, dig into feedback, and improve the checks. If VAS flags something you don’t understand, ask us. If there’s a platform or security check you want us to add, tell us.

We’ve spent years finding the holes. Now we want to help you catch them before someone else does.

Jacob (Co-founder of Vibe App Scanner)