Live now. Sign up free, paste your app’s address, and this works from your dashboard. What is live today lists what is still to come.
From the outside
An external scan of your live app looks at what anyone on the internet can see: TLS, DNS, security headers, cookies, exposed files and pages, and libraries served in your public bundle. Asset discovery finds what there is to test, which is where coverage comes from.
Scanning is safe mode only. Active attack testing is never switched on by default.
Data exposure tests, read only
Once you have proved the app is yours, the outside scan also tests what your app’s public client key, the one every browser already receives, can read from a hosted backend: whether it can list your tables, read rows from them, read rows that belong to a particular user, or list files in a storage bucket.
These tests only ever read. VibeLock never creates an account, never writes, and keeps only table, column and bucket names and a row count, never a value. They never run in the passive preview. If the scan finds a server key in your bundle, that is a critical finding and the key is never used.
From the inside
Through the MCP server or your repository host, the inside checks look at dependencies with known vulnerabilities, leaked secrets, routes missing authentication, injection patterns, database access rules such as row level security, and the AI tool configuration files and build workflows in your repository, which count as part of your app.
The areas
Every check belongs to one of these areas. Only the checks that apply to your app are run, worked out from what the scan finds, such as user accounts, file uploads, payments or an AI feature.
- Authentication and sessions
- Access control
- Input and injection
- Secrets and cryptography
- Data and privacy
- Encryption in transit
- Errors and logging
- Business logic and abuse
- Files and uploads
- API and web services
- Configuration and dependencies
- AI security and transparency
- Agents, tools and MCP servers
- Retrieval and memory
- AI-built code and toolchain
- Governance and consistency
Where the checks come from
VibeLock does not invent requirements. The checks cite published sources: OWASP ASVS 5.0 and OWASP AISVS 1.0, the application-level articles of the GDPR, the EU AI Act and the EU ePrivacy Directive, the OWASP LLM Top 10 2026 and the OWASP Top 10 for Agentic Applications 2026. Showing a passing check is never a claim that the app meets any of them in full.
Features you do not have
Checks for AI features, agents and retrieval apply to every app that uses AI, and pass when VibeLock verifies the feature is absent. Until that absence is confirmed, they count as not yet checked, so coverage can dip at first. That is intended: absence is verified, not assumed.