Hey Sumo-lings 👋

We’re the two founders behind Vibe App Scanner, and between us we’ve spent almost two decades working in cybersecurity.

Before VAS, we were doing code and security audits through our agency. More and more of the apps landing in front of us were built with tools like Lovable, Base44, Replit, Claude, Codex, etc.

A lot of them looked great. They worked. They were ready to show customers.

Then we looked under the hood.

We kept finding the same problems: Supabase tables anyone could read, service-role keys sitting in frontend code, APIs that trusted whatever user ID they were given, and authentication that stopped at “is this person logged in?” without checking what they should actually be allowed to access.

The founders building these apps weren’t careless. The tools had helped them ship quickly, but checking the security still required knowledge most founders understandably don’t have.

We built Vibe App Scanner to make that part much easier.

Paste in the URL of your live app, and VAS checks what is actually exposed. It goes beyond the usual security header checklist to inspect your JavaScript, discover APIs, test database access controls, check authentication, and look for the mistakes we saw during real audits.

It also understands the stacks AI-built apps commonly use. For example, a Supabase anon key is meant to be public. A Supabase service-role key absolutely is not. That distinction sounds simple, but plenty of generic scanners get it wrong.

The bit we’re proudest of is what happens after VAS finds something.

You don’t just get a scary vulnerability name and a link to a technical article. You get the evidence, an explanation you can understand, and a copy-paste fix you can hand straight to Lovable, Cursor, Claude Code or your developer.

Fix it, scan again and check that it’s really gone.

VAS also checks performance, accessibility, SEO, compliance, email security and AI search visibility, so you get a much better idea of whether your app is ready to launch, not just whether the homepage looks finished.

We’re bringing VAS to AppSumo because we know how much this community builds and ships. We also know that most small teams don’t have a security engineer sitting beside them every time they push an update.

We’ll be here throughout the campaign to answer questions, dig into feedback, and improve the checks. If VAS flags something you don’t understand, ask us. If there’s a platform or security check you want us to add, tell us.

We’ve spent years finding the holes. Now we want to help you catch them before someone else does.

Jacob (Co-founder of Vibe App Scanner)