Vibe App Scanner Reviews

I ran a scan on my site through MCP from my AI assistant: start it, poll the status, read the report. The report sorts findings by severity. Medium were a DMARC policy still on “none” and a missing X-Frame-Options header. Low ones included missing DNSSEC, COOP and CORP headers, and HSTS without includeSubDomains and preload. It also flagged a missing og:image on two pages, no structured data on my article index, no llms.txt, no terms of use and no accessibility statement.

Each finding names the affected URL, so I could check it against my source before changing anything. I’m fixing them now and will post the rescan result here. DNSSEC has to wait for me.

I originally purchased Tier 1 of VAS, but after getting a chance to use it, I quickly upgraded to Tier 2. That alone should tell you how I feel about the product!

VAS does exactly what it's designed to do, and it does it well. As someone working with vibe-coded applications, having a tool that helps identify security vulnerabilities and provides actionable guidance is incredibly valuable.

Is it 100% perfect? No, but it's pretty darn close. And what really sets VAS apart is Jacob, the developer behind it. He's extremely responsive, quick to address any issues that come up, and genuinely willing to help you understand the platform and get the most out of it. He's also very receptive to feedback and suggestions, which is something I really appreciate.

It's clear that Jacob cares about this product and the people using it. I don't see VAS as something that's going to sit stagnant after an AppSumo launch. I genuinely believe it has a bright future and will only continue to improve as new features and refinements are introduced.

If you're building vibe-coded applications and want an extra layer of confidence when it comes to security, VAS is absolutely worth checking out.

I wish I could give more than 5 tacos. Jacob has earned them!

I’ve been experimenting with "vibe coding" for a few months, so trying out VAS seemed like a good idea.
So far, I’ve noticed it has detected some issues in my applications, making it a solid addition to my tech stack. I do think the UI/UX needs a bit of polishing, though. The website and monitoring options serve very similar purposes, yet somehow, it’s not entirely clear why they are kept separate. The email leak detection feature gives the impression of being a one-off tool. I have to admit I haven’t used MCP or the API, so perhaps I’m being a bit harsh by giving it 4 tacos instead of 5.

I’ve been testing VAS on a real Supabase/Vercel app, including authenticated scanning, and it has already surfaced useful findings and deployment-level visibility that complements code-level security reviews very well.

What stands out most is how practical the product feels: the reports are actionable, the authenticated checks are genuinely useful, and the team is extremely responsive.
I reported a login issue and shared some feedback on scan coverage and reporting, and Jacob reproduced the issue, fixed it quickly, and engaged seriously with the suggestions.

Still a young product, but already valuable in real-world use and clearly improving fast.

Disclaimer: I'm a paid product tester for AppSumo and received this tool for free to provide a detailed review. My opinions are entirely my own, and my compensation is not tied to the rating or taco score I give.

One of the problems with vibe coding is that you can get an app working long before you know whether it is safe to put in front of users.

Vibe App Scanner gives you a way to check the app you have deployed by entering its URL. It runs more than 150 checks, including exposed API keys, authentication issues, database permissions, and other security problems that can easily go unnoticed when you're focused on getting the app working.

What I particularly like is how it handles the findings. Each issue comes with an explanation, supporting evidence, and suggested fixes you can give to your AI coding tool. You can take those instructions back to Lovable, Cursor, Claude Code, or your developer, make the changes, and scan again to check the results.

For someone developing software with AI, I can see this becoming part of the development process. You make changes to your app, deploy them, run a scan, and address anything new that comes up. It also supports MCP, so you can connect it to your AI coding tools without having to manually copy everything between applications.

In my test, the scanning and suggested fixes worked well. I initially flagged a couple of things that would make the product more useful, particularly PDF reports for sharing findings with clients and a REST API for connecting scans and reports to other tools. The team added both, and I confirmed they were available in my retest.

I would still want a proper security review for an application handling sensitive data, but Vibe App Scanner gives founders and developers a way to catch common issues during development and after deployment.

Overall, I like the direction of this product, particularly for people using AI to develop software who may not have a security background. The ability to scan a deployed app, get specific instructions for addressing the findings, and check the results after making changes is what makes Vibe App Scanner worth considering.