Security for vibe-coded apps · powered by anal-probe
Continuous black-box security for AI-built software. Leaked keys, exposed .env, broken headers, framework footguns — ranked for agents with fix packs & Gherkin. Prove you own the app (domain email + inbox click, or DNS TXT). Then scan on a schedule or every commit.
Instant check for leaked secrets, exposed config, core security headers & DNS. Full suite unlocks after domain-email inbox proof or DNS TXT.
Sign in with an email on the domain you are testing and click the inbox verify link — or place a DNS TXT record. No scanning other people’s apps.
Every finding becomes a ranked P1→Pn prompt for Claude / Cursor / Codex.
Weekly · daily · or every commit/deploy webhook.
Full test suite
The homepage grid is 13 categories— under them sit 150+ fixed black-box probes plus a 213+ client CVE version ranges (363+ rules the full engine can evaluate). Runtime multiplies further: every cookie, script bundle, and crawl page gets re-checked. Lite samples four categories; paid fleet runs the full OSS suite.
lite = included in free homepage scan (4 categories, sampled). Full fleet + history needs ownership + a paid plan.
13+ probes · secrets
HTML + every same-origin JS bundle scanned for real credentials. Public keys (pk_live, anon) ignored. Source maps flagged when downloadable.
40+ probes · exposure
27+ paths body-validated (no SPA false positives), plus stack traces, GraphQL introspection, directory listings, robots sensitive paths.
45+ probes · security
Deepest category: required headers, CSP weakness grading, cookie flags, TLS grade, open redirects, SRI, JWT hygiene, host-header, CSRF heuristics, DOM-XSS sinks.
4+ probes · dns
SPF + DMARC policy strength, CAA (who may issue certs), dangling-CNAME subdomain takeover heuristics — all passive DNS.
20+ probes · framework
Fingerprints Next.js, WordPress, Laravel, Django, Rails, Spring, ASP.NET — probes stack footguns only on confident match.
213+ version ranges · components
OWASP A06: fingerprint jQuery, Bootstrap, Lodash, AngularJS, Vue 2, axios… against an auto-updating feed of version ranges.
5+ probes · reliability
Homepage health, broken same-origin links/images (sampled), mixed content on HTTPS pages.
7+ probes · seo
Title, meta description, Open Graph, canonical, single h1, robots.txt, sitemap.xml.
4+ probes · a11y
html lang, viewport, images missing alt, unlabeled form inputs (WCAG starter checks).
4+ probes · performance
Compression, oversized HTML, script count, cache headers on static assets.
8+ probes · agent
Is your deploy consumable by AI crawlers? llms.txt, robots AI bots, SSR text density, structured data, MCP/ai-plugin manifests.
3+ probes · host
Resolved IPs, reverse DNS, CDN/hosting fingerprint — no port scanning in default mode.
user-defined · plugins
Drop JSON templates (status/header/body matchers) for org-specific checks with zero code.
Opt-in modes and white-box helpers — not silent "we test everything" claims. Active exploit fuzzing (SQLi/SSRF) stays out of scope on purpose.
Authorization-gated port/service ID; optional NVD CVE correlation (identify-only).
Every reachable page: JS errors, broken assets, safe reflected-input probes.
Playwright browse: does the UI actually load and accept input?
Two-account cross-tenant leak test for multi-tenant apps.
npm advisory audit when you point at a repo / lockfile context.
IDOR, RBAC, mass-assignment, data-isolation probes for your own test suite.
How we count (honestly): ~150+ are discrete black-box probes in the engine. ~213+ are client-library version ranges (12 libs, 117+ CVE refs) matched when those libraries appear on the page. A single full scan often emits 40–120 findings depending on the target; crawl/recon modes add more. We do notclaim "1,000 tests" as fixed checkboxes — that would be inflated. The surface is large because of rules + dynamic coverage, not fake line items.
Pricing
Open-source CLI is free forever. Hosted plans add ownership verification, dashboard, cadence, and commit hooks.
Public homepage lite scan — tease the full suite
1 full security scan per week for one verified app
Full scan every day — catch regressions while you vibe
Scan on every push / deploy — continuous ship security
The scanner engine is Apache-2.0. Run it locally, in CI, or fork it. Hosted VibeTesting Agent adds auth (WorkOS), billing (Stripe), ownership gates, and always-on cadence.
npx github:newsengine/anal-probe review https://your-app.example.com
vibetesting-verify=… on the host (or _vta.) in your DNS control panel