Bottom line: Vibe App Scanner (VAS) takes the URL of a live app, often one built with Lovable, Replit, Cursor or Claude Code, and runs “150+ targeted checks” for the mistakes AI coding tools tend to make: exposed keys, broken auth, open Supabase tables. Each finding comes with evidence, an explanation and a fix you can paste back into your AI tool. On AppSumo it sells three tiers, $49, $119 and $249 once, read on 29 October 2026. The detail that decides the purchase: Tier 1 runs scans by hand only. It has no weekly scan automation, no breach monitoring, no MCP and no API, and the founder says it gets no repository scanning either. The deal is “Refundable up to 60 days,” and the listing says “Plus members are covered by our We Got Your Back guarantee.” The vendor’s own sales are final, so AppSumo is the only place we found a refund.
Best for: founders and small teams shipping apps built with AI tools who don’t have a security engineer and want a repeatable check before each launch.
Think twice if: your app handles sensitive data and you need a proper audit, it’s a Laravel or PHP app, or it sits behind Cloudflare’s interactive CAPTCHA.
We have no affiliate deal with Vibe App Scanner or AppSumo; links go to the official pages. How we review.
Updated 29 October 2026. This Vibe App Scanner review rests on what we read that day: the Vibe App Scanner listing on AppSumo, including all three tiers, the deal terms, the reviews and the founder’s answers to buyer questions, plus the vendor’s pricing page and refund policy. We haven’t scanned an app with it, so we describe the plans, the limits and what buyers report, not how accurate the scanner is.
Vibe App Scanner review at a glance
| What we checked | What the pages say |
|---|---|
| AppSumo tiers | $49, $119, $249 once |
| Scans a month | 15, 50, 150 |
| Websites | 3, 10, unlimited |
| Weekly automation, breach monitoring, MCP | Tiers 2 and 3 only |
| API access | Tier 3 only |
| Repository scans (beta) | None on Tier 1; 20 and 50 a month on Tiers 2 and 3, per the founder |
| Vendor’s own plans | Go $29 a month, Pro $49 a month; “All sales final” |
| Refund | “Refundable up to 60 days” on AppSumo |
| AppSumo guarantee | “Plus members are covered by our We Got Your Back guarantee” |
| Listing rating | 4.71 stars from 7 reviews, 184 bought |
What Vibe App Scanner does
You paste in the address of your deployed app. VAS works out the stack it’s running on, with “React, Supabase, Vercel, and 20+ platforms recognized out of the box,” according to the listing, and then probes the app the way an outside attacker would. You can add login credentials so it also tests what a signed-in user can reach, which is where access-control bugs tend to hide.
The listing groups what you get into four parts:
- Scanning: “150+ targeted checks tuned for the vulnerabilities AI coding tools most commonly introduce,” plus optional authenticated scans.
- Ranking: findings sorted by severity and labelled, for example “exposed secrets, RLS misconfigs, and missing headers,” each with a plain-English note on what an attacker could do.
- Tracking: a history of every scan and a security score, with comparisons “across deploys or environments” to catch new issues.
- Fixing: “ready-to-use remediation code” for your AI tool or editor, and “the raw JSON evidence behind every finding.”
The founders’ note on the listing says they spent “almost two decades working in cybersecurity” between them, and ran code and security audits through an agency before building VAS. Their example of what a generic scanner gets wrong is a fair one: a Supabase anon key is meant to be public, a service-role key absolutely is not. The note also says VAS checks performance, accessibility, SEO, compliance, email security and AI search visibility, not only security. The vendor’s pricing page confirms that every live-app plan runs that full suite. The listing names Google Firebase, Stripe and Supabase as integrations. The company is listed as founded in 2025 in Canada, with 1-10 people, bootstrapped.
The limit most people miss: Tier 1 doesn’t watch your app
Read the tier cards slowly. All three include “Full on demand scanning” and “Copy-paste fix for your AI tool.” After that, the ticks split:
- License Tier 1 ($49): 15 scans a month, 3 websites. Crosses next to email breach monitoring, weekly scan automation, MCP access and API access.
- License Tier 2 ($119): 50 scans a month, 10 websites. Ticks for breach monitoring, weekly automation and MCP; a cross next to API access.
- License Tier 3 ($249): 150 scans a month, unlimited websites. Ticks on every line.
So Tier 1 is a manual tool. You remember to scan, you scan, you fix. In practice, the bugs that hurt AI-built apps often arrive with the next prompt you give your coding tool, not on launch day, and the weekly automation is what catches a change you forgot to check. If you’ve got a habit of shipping small changes several times a week, that missing tick matters more than the scan count.
There’s a second split most people miss, because it isn’t on the cards at all. On 26 October 2026 a lifetime buyer asked whether repository scans, which check your source code rather than the live site, are part of the deal. The founder, Jacob Perks, answered the same day: “Current AppSumo repository allowances are 20 scans per month and 3 saved repository/folder targets for Tier 2, and 50 scans per month and 10 targets for Tier 3. Tier 1 does not include repository scanning.” He added that the feature is in beta and that the company will “make post-beta inclusion and limits explicit in the published terms before beta ends.” Until it does, treat repository scanning as a beta bonus on Tiers 2 and 3, not something you’ve bought.
| Plan | Price |
|---|---|
| License Tier 1 One founder, a few apps |
$49 once |
| License Tier 2 Builders who want weekly scans and MCP |
$119 once |
| License Tier 3 Agencies and API users |
$249 once |
One-time prices on AppSumo, read 29 October 2026; the listing shows struck-through prices of $240, $350 and $480. Vibe App Scanner's own site sells Go at $29 a month and Pro at $49 a month for new accounts, with all sales final and a free first scan.
Prices checked Oct 29, 2026 on Vibe App Scanner’s own pricing page. Lifetime deals are listings that can end or change, so check the live listing before you buy.
Picking a plan: worked examples
The scan counts look generous until you divide them by sites and weeks. Here are four cases, using only the limits on the cards.
A solo founder with one app. Fifteen scans a month on Tier 1 is about three a week for that single app. That’s enough to scan after each meaningful deploy, provided you remember to. The 3-website limit leaves room for a staging copy, which the founder recommends for sites behind Cloudflare.
A founder with three small apps. Tier 1’s 15 scans split three ways is five scans per app a month, a little more than one a week each. Turns out that’s tight if you also re-scan after each fix, which is the loop the listing describes (“Fix it, scan again and check that it’s really gone”). One scan to find issues and one to confirm the fix uses two of your five.
A freelancer with eight client apps. That’s past Tier 1’s 3 websites, so Tier 2 it is. Fifty scans across eight apps is about six each per month. If the weekly automation counts against the monthly quota, eight apps scanned weekly would use roughly 35 of the 50 (eight apps times about 4.3 weeks), leaving around 15 for manual re-scans. We couldn’t confirm on either page whether automated scans count toward the 50, so ask before you plan around it.
An agency with 30 client sites. Only Tier 3 has unlimited websites. A weekly scan of 30 sites is about 129 a month, which fits inside 150 with roughly 20 spare. Tier 3 is also the only tier with API access, which you’ll want if you’re pulling reports into your own dashboards or client portals.
Honestly, the clearest rule from these sums is this: count sites first, then decide whether you need scans to happen without you. If either answer pushes you past Tier 1, skip the $49 tier rather than planning to upgrade later. The terms say “you can upgrade while the deal is live,” and one buyer wrote on 28 October that they “only got Tier 1” and couldn’t upgrade in time. Deals end; don’t forget that.
The deal vs Vibe App Scanner’s own plans
The vendor’s own pricing page, read on 29 October 2026, sells two subscriptions for new accounts. Its refund policy says “All payments are final and non-refundable,” and offers a free first scan instead, which shows your score, your issue counts and “one finding revealed in detail.”
| Vibe App Scanner’s own plan | Price | Live-app scans | Repository scans | Projects | Monitoring |
|---|---|---|---|---|---|
| Go | $29 a month | 20 a month | 10 a month | Up to 3 | Not listed |
| Pro | $49 a month | 150 a month | 50 a month | Up to 10 | Weekly deep scans, alerts, breach monitoring |
The deal terms tie AppSumo buyers to “All future Go (Tier 1), Pro (Tiers 2, 3) plan updates.” Line them up and they don’t match exactly:
Tier 1 vs Go. $49 once is less than two months of Go. But Tier 1 gives 15 live-app scans where Go gives 20, and no repository scans where Go includes 10. You get the Go plan’s updates, not the Go plan’s allowances.
Tier 2 vs Pro. $119 once is under two and a half months of Pro. You get weekly automation and breach monitoring, as Pro does, but 50 scans a month rather than 150, and no API.
Tier 3 vs Pro. $249 once is about five months of Pro ($245). It matches Pro’s 150 live-app and 50 repository scans, and goes further on sites: unlimited websites against Pro’s 10 projects. If you’d keep Pro for more than five months, Tier 3 is the better buy on these numbers.
The listing shows struck-through prices of $240, $350 and $480 beside the three tiers, and an “80% off” label on Tier 1. Those are the listing’s own figures; we’d judge the deal against the $29 and $49 monthly plans above instead. The 60-day refund matters here too. When you buy direct, there’s no refund at all.
What buyers report
The listing shows 4.71 stars from 7 reviews, with 184 bought. That’s a small sample, so we read all five reviews shown and the latest questions.
Useful findings, beyond security. A buyer on 22 September 2026 said VAS caught that the visible labels on their form fields weren’t attached to the fields, and “gave me the exact prompt to fix it.” They praised the founder’s pre-sale answers as specific “not just form responses.”
Some wrong detections. On 23 September a reviewer opened with “I wouldn’t trust the scan reports 100% at the current state.” Their report said the app ran on Vercel when it doesn’t, and told them to allow YouTube embeds that their app doesn’t use. Following that advice “blindly,” they wrote, would open “an unnecessary open attack surface.” The founder replied the same day: “I’ve reproduced both issues and will correct the detection rules.” Don’t trust a stack label just because it appears in the report; when you know your own hosting, you’re the better judge.
A paid tester’s view. A 25 September reviewer, who says they’re “a paid product tester for AppSumo” and received the tool free, said the scans and fixes worked well, and that the team added PDF reports and a REST API after their first round of feedback. They also wrote: “I would still want a proper security review for an application handling sensitive data.” The founder agreed that automated scans “complement, rather than replace” one.
Interface rough edges. A 2 October reviewer liked the findings but called the UI in need of polishing, with scans and monitoring kept separate for no clear reason. On 20 October another buyer wrote: “I originally purchased Tier 1 of VAS, but after getting a chance to use it, I quickly upgraded to Tier 2.” Don’t forget that upgrades only work while the deal is live.
Cloudflare and firewalls. On 16 October a buyer asked why some checks ended as “could not finish.” The founder said Cloudflare’s interactive CAPTCHA “can prevent some checks from completing,” and that the company doesn’t “currently guarantee getting through those challenges.” He suggested scanning a staging copy instead. On 26 October he added that there’s no published scanner IP or user-agent allowlist yet, and asked buyers: “Please don’t disable your production WAF to accommodate a scan.”
No public roadmap. Asked on 18 October, the founder said there’s no public roadmap or changelog yet.
Repository scans, privacy and false positives
The longest answer on the listing came on 26 October 2026, when a buyer running a Laravel and Inertia project sent nine numbered questions. It’s worth reading in full if you’ve got private code, because the founder was candid about gaps.
What leaves your machine. For repository scans, the founder wrote: “We don’t maintain a permanent clone of your repository.” Analysis uses temporary working files that are cleaned up afterwards, while reports and redacted evidence are kept, with “a 30-day retention window” for repository reports. When the AI review step runs, “bounded, redacted code context is sent to the configured AI provider.” The GitHub App asks for “Contents: read and Metadata: read,” not write or admin rights, and he recommends installing it only on selected repositories.
What isn’t built yet. Repository scans can’t be started or exported through the MCP or REST tools so far, there’s no supported GitHub Action for scanning on each push or pull request, and Laravel route and PHP data-flow analysis isn’t “first-class.” None of these has a release date.
Silencing noise. Supported findings can be marked with “Save persistent decision,” including a false-positive reason, and that decision carries forward while the evidence stays the same. Older findings may only take per-scan feedback.
Planned scope. An 11 October answer listed what repository scanning is meant to cover: “SAST-style checks for insecure code patterns,” vulnerable dependency checks “initially npm,” secret detection for committed credentials and private keys, and private GitHub repositories you explicitly grant access to.
Getting fixes into your editor. On 28 October a buyer asked whether VAS writes prompts for fixing what it finds. The founder’s reply, posted today, 29 October, pointed to an “AI Fixes & Export” option that downloads a Markdown report with findings, evidence and remediation guidance for your coding tool, and advised reviewing the proposed changes before accepting them.
Most people miss how much of this is still labelled beta. Honestly, that’s fine for a tool launched in 2025, provided you buy for what the live-app scanner does today and treat the code-scanning roadmap as a maybe.
The terms
The deal terms read:
- “Get lifetime access to Vibe App Scanner.”
- “All future Go (Tier 1), Pro (Tiers 2, 3) plan updates.”
- “If the plan name linked to your deal changes, it will automaticallytransfer to the new plan with all updates.”
- “Activate your license within 60 days—you can upgrade while the deal is live but can only downgrade within 60 days of purchase.”
- “Access to all future AI models may be provided at a discounted rate OR Access to future AI models may require an add on.”
The listing says “Refundable up to 60 days” and “Plus members are covered by our We Got Your Back guarantee.” The last term is the one to weigh. The founder also told a buyer that “AI review has separate usage limits” for repository scans, so the AI parts of this product may cost extra over time.
Vibe App Scanner vs Detectify and Snyk
The listing names Detectify and Snyk as the tools it’s an alternative to. We didn’t read or price either for this review, so we won’t compare features or prices. What we can say from the VAS pages: VAS is built around apps made with AI coding tools, scans the deployed app from its URL, and writes fixes meant to be pasted back into those tools. Its code repository scanning, the part closest to what code-scanning tools do, is still in beta and covers npm lockfiles first, per the founder. If you already run a mature code-scanning setup on your repositories, VAS is more likely an extra check on the live app than a replacement.
Common mistakes with the Vibe App Scanner deal
Buying Tier 1 for monitoring. It has no weekly automation or breach monitoring. Those start at Tier 2.
Counting on repository scans in Tier 1. The founder says Tier 1 doesn’t include them.
Buying Tier 2 for the API. API access is Tier 3 only, per the card. If you’ve planned a dashboard around it, skip the middle tier.
Pasting every fix without reading it. One reviewer’s report suggested opening a frame source they didn’t need. When you hand a fix to your AI tool, read the diff before it ships.
Turning off your firewall to finish a scan. The founder advises against it. Scan a staging copy instead.
Treating a clean scan as an audit. Both a reviewer and the founder say it complements a proper security review, not replaces one.
Who Vibe App Scanner suits
A non-technical founder with one AI-built app. Tier 1 gives you a manual pre-launch check with fixes your coding tool can apply.
A builder who ships every week. Tier 2, for weekly scans you don’t have to remember, plus MCP for connecting it to your AI tools.
An agency or freelancer with many client apps. Tier 3, for unlimited websites and the API.
A team building on Laravel or PHP. Think twice; the founder says framework-aware coverage isn’t there yet.
How to test it inside the refund window
- Scan your main app on day one, with login credentials, so the signed-in checks run too.
- Check every finding against your real stack. Note any wrong detections, as one reviewer found.
- Apply one fix through your AI tool, re-scan, and confirm the finding is gone.
- If you’re behind Cloudflare, scan a staging copy and see which checks still can’t finish.
- Ask support in writing whether weekly automated scans count toward your monthly quota, and what happens to repository scans after the beta.
What we couldn’t check
We didn’t scan any app, so we can’t speak to how many real issues VAS finds or how often it’s wrong. We couldn’t confirm whether automated weekly scans count against the monthly scan allowance, what repository scan limits will be after the beta, or what future AI model add-ons would cost. Get answers to all three before day 60.
FAQ: Vibe App Scanner questions
Is Vibe App Scanner a one-time payment on AppSumo?
Yes. License Tier 1 is $49, Tier 2 is $119 and Tier 3 is $249, once, read on 29 October 2026.
Does the Tier 1 deal include weekly scans and monitoring?
No. Tier 1’s card shows crosses next to email breach monitoring, weekly scan automation, MCP access and API access. Those start at Tier 2, and the API at Tier 3.
Can I get a refund on Vibe App Scanner?
On AppSumo, yes: “Refundable up to 60 days.” On the vendor’s own site, no: its refund policy says “All payments are final and non-refundable,” and offers a free first scan instead.
Does Vibe App Scanner replace a security audit?
No. A reviewer said they’d still want a proper review for apps with sensitive data, and the founder replied that automated scans “complement, rather than replace” one.
The verdict
Vibe App Scanner fills a real gap: people shipping apps built with AI tools rarely know what an attacker would look at first, and VAS turns that into a list of ranked findings with fixes their tools can apply. The founder is unusually present on the listing and answers questions in detail. The catch is the tier split. Tier 1 is a manual scanner with fewer scans than the vendor’s own Go plan and no repository scanning, so most builders who ship often should start at Tier 2, and agencies at Tier 3. Some early detections were wrong, and AI features may cost extra later. With 60 days to change your mind, test it on your real app, read every fix, and decide before the window closes.
Vibe App Scanner on our desks
Our YouTube channels cover Vibe App Scanner from different angles. Each video opens on YouTube.
Guides on Business Software
- Are Lifetime Deals Worth It? A Checklist Before You Pay OnceA lifetime deal can pay for itself in months, or tie you to a tool that stops improving. A payback test, five questions to ask, and how AppSumo's refund window works.