Guide · Updated July 12, 2026

What is a vulnerability scan?

A vulnerability scan is an automated check that probes a website or application for known security weaknesses — misconfigured headers, leaked secrets, weak authentication, outdated dependencies, and more. Think of it as a smoke alarm for your site: it won't fix problems for you, but it tells you where they are before someone else finds them.

How a vulnerability scan works

A scanner sends carefully crafted requests to your site and inspects the responses. It reads HTTP headers, parses HTML and JavaScript, checks cookies, looks at TLS and DNS configuration, and — in deeper scans — fingerprints the frameworks and libraries you're running. Each check maps to a well-known class of vulnerability (for example, missing Content-Security-Policy, cookies without HttpOnly, or exposed source maps).

What a vulnerability scan finds

• Exposed secrets — API keys, tokens, and credentials shipped in client bundles.
• Auth & session flaws — cookies without Secure / HttpOnly, weak SameSite, missing route protection.
• Injection surface — patterns that hint at XSS, SQLi, or open redirects.
• Missing security headers — CSP, HSTS, X-Frame-Options, Referrer-Policy.
• Outdated dependencies — known-CVE versions of libraries loaded on the page.
• Information disclosure — sourcemaps, backup files, verbose error pages, server banners.

Why AI-generated and "vibe-coded" apps need one

Apps generated or heavily assisted by AI ship fast — often without a traditional security review. The same patterns show up again and again in vibe-coded projects:

• Service-role or admin API keys embedded in the frontend.
• Database tables exposed publicly because row-level security was never enabled.
• Auth flows that "work" but don't actually verify the user on protected routes.
• File uploads that accept anything and store it under a public URL.
• Third-party scripts pulled in without a Content Security Policy.

A vulnerability scan catches these before your users — or an attacker — do.

Vulnerability scan vs penetration test

A vulnerability scan is automated and broad; a penetration test is manual and deep. Scans run in minutes and are meant to be repeated (every deploy, every week). Pen tests are performed by humans, take days, and validate whether findings can actually be exploited. Most teams start with regular scans and reach for a pen test only when the stakes are high.

How often should you scan?

After every meaningful change, and at least once a month for a live site. New dependencies, new routes, and new auth flows all introduce new surface — a scan takes seconds and closes the loop.