FAQ · Updated July 21, 2026
Vulnerability scanning FAQs
Plain-English answers to the questions we hear most about vulnerability scanning, vibe-coded apps, and how to fix security findings.
What is a vulnerability scan?
A vulnerability scan is an automated test that probes a website or web application for known security weaknesses. It checks HTTP headers, cookies, page content, JavaScript bundles, TLS configuration, and public metadata for issues such as missing security headers, exposed secrets, weak authentication, and information disclosure. The result is a ranked list of findings with severity, explanation, and guidance on how to fix each one.
What does a vulnerability scan look for?
Vulnerability scans look for common web security issues. Typical checks include Content Security Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, cookie flags such as HttpOnly and Secure, exposed API keys or tokens, open redirects, cross-site scripting (XSS) patterns, sourcemap exposure, verbose server banners, and outdated third-party dependencies. Deeper scans may also fingerprint frameworks and inspect DNS records for SPF and DMARC issues.
What is a vibe-coded app?
A vibe-coded app is a website or application built primarily with AI-assisted tools, low-code platforms, or rapid prototyping workflows. These projects ship quickly, but they often skip traditional security review steps. The result is the same public-facing attack surface as any web app, created in a fraction of the time. Vibe-coded apps benefit from regular automated scans because security gaps can be introduced as quickly as features are.
Are AI-generated apps less secure than hand-written apps?
Not necessarily. AI-generated code is not inherently less secure, but it is often produced without the manual review steps that catch subtle security mistakes. Common issues include hardcoded secrets, missing row-level security, overly permissive API keys, and weak session handling. Regular scanning closes that gap by catching these patterns automatically.
How long does a vulnerability scan take?
Most scans complete in seconds. A standard scan covers public-facing headers, page content, cookies, and JavaScript bundles. A deep scan adds dependency fingerprinting, sourcemap probing, and additional surface checks. The exact time depends on the size of the target and how quickly it responds to requests, but the majority finish well under a minute.
Can a vulnerability scan break my site?
No. VibeCoden't uses non-destructive, read-only probes. It only inspects what your site already serves publicly. It does not attempt to exploit vulnerabilities, modify data, or perform actions that could affect users or infrastructure. You can run scans against production sites safely.
What is the difference between a standard scan and a deep scan?
A standard scan checks the most important security surface: headers, cookies, secrets, auth patterns, and common injection risks. A deep scan adds more thorough checks such as sourcemap exposure, framework fingerprinting, DNS and email authentication records, and additional dependency probes. Both produce downloadable fix prompts; the deep scan simply covers more surface.
What are downloadable fix prompts?
Downloadable fix prompts are pre-written instructions you can paste into your AI coding assistant or agent. Each prompt explains the finding in plain English, why it matters, and exactly what code or configuration changes to make. They turn scan findings into actionable, copy-paste-ready tasks for Cursor, GitHub Copilot, ChatGPT, Claude, or any other agent you use.
How do I fix the findings in a scan report?
Each finding includes a severity label, a short explanation, and a recommended fix. For paid scans, you can download a prompt that describes the change in detail and can be given directly to an AI agent. Fixes usually involve updating web server configuration, adding security headers, rotating exposed keys, enabling row-level security, or tightening cookie and session settings.
What is a security header?
A security header is an HTTP response header that tells browsers how to handle your site. Examples include Content-Security-Policy, which restricts what scripts can run; Strict-Transport-Security, which forces HTTPS; X-Frame-Options, which prevents clickjacking; and Referrer-Policy, which controls how much information is sent with outbound links. Missing or misconfigured headers are one of the most common findings in automated scans.
What is an exposed secret?
An exposed secret is any credential or token that is accidentally included in client-side code or served publicly. Common examples are API keys, service-role keys, database connection strings, JWT secrets, and OAuth client secrets. Once exposed, these keys should be rotated immediately because they can be extracted by anyone who visits the site.
Do I need to be a developer to use VibeCoden't?
No. The scan is designed to be simple: paste a URL, choose a scan type, and review the results. Findings are written in plain English, and paid scans include downloadable prompts that can be handed to an AI agent or developer. Technical users get detailed context; non-technical users get clear next steps.
Is there a free vulnerability scan?
Yes. Every visitor can run one free Lite scan per day. The Lite scan checks the same public surface and returns a summary, an overall score, and severity counts. Detailed findings, downloadable fix prompts, and additional scans are available through paid plans.
How are credits used?
Credits are consumed when a paid scan completes successfully. Standard scans use one standard credit; deep scans use one deep credit. If a scan fails to complete, the credit is refunded. Lite scans are free and do not require credits. Unused credits do not expire as long as your account is active.
How often should I scan my site?
Scan after every meaningful deployment and at least monthly for a live site. New routes, dependencies, auth flows, and third-party scripts all change your attack surface. Regular scans make sure new issues are caught before they are found by attackers.
What is the difference between a scan and a penetration test?
A vulnerability scan is automated and broad. It quickly checks for many known issues across a site. A penetration test is a manual, time-consuming engagement where a security expert attempts to exploit weaknesses and chain them into real attacks. Scans are best for continuous, routine checking. Penetration tests are best for high-stakes validation before major launches or compliance reviews.
Can I scan a site that is not yet live?
Yes. Use the code and file scanner on the homepage to paste HTML, JavaScript, or CSS, or upload a file. The scanner inspects the content for exposed secrets, missing headers, and common vulnerability patterns without requiring a public URL.
Does VibeCoden't store scan results?
Authenticated scan results are stored in your account so you can view them later. Lite scans are stored temporarily for rate-limiting purposes. We do not sell or share scan data. Details are covered in the privacy policy.
How do I get in touch?
Visit the contact page linked in the footer, or use the legal contact route on the site. We respond to security questions, billing questions, and feature requests.
Ready to scan your site?
VibeCoden't runs fast, non-destructive scans tuned for vibe-coded and AI-generated apps. Paste your URL and get a report in seconds.
Run a scan