How to Scan Your Vibe Coded App for Security Issues

The vibe coding security gap#

Vibe coding, building software by describing features to AI tools in plain language, changes what kind of work is done by the developer versus the AI. The AI handles writing code. The developer handles deciding what to build. This works remarkably well for functionality. It works poorly for security, not because the AI cannot write secure code, but because security is not part of "making it work."

When you ask an AI to build a web app, it sets up routes, connects to a database, renders a UI, and makes API calls. That sequence covers everything needed to produce a functional product. Security measures sit outside that loop. They require knowing what headers the server should send, what DNS records the domain should have, and what flags cookies should carry. None of those things affect whether the app runs, so AI tools rarely touch them.

There are also structural reasons why specific vulnerabilities appear so consistently. Hardcoded secrets feel convenient at development time. CORS gets opened wide so API calls work during local development and the restriction is never tightened before launch. Environment files are created but not blocked from public access because blocking them requires server configuration knowledge that is outside the scope of "make the feature work."

This is not a criticism of AI coding tools. They are doing exactly what they are designed to do. The gap is structural, and it exists for every app built this way. The fix is straightforward once you know what to look for.

Common security issues in AI-generated apps#

These seven issues appear in the vast majority of vibe-coded apps. They range from critical vulnerabilities that expose your secrets to lower-priority gaps that are easy to close once you know they exist.

Scan your app in 30 seconds#

To run a scan, you need a deployed URL. The scanner tests live HTTP responses, so localhost does not work. Your Vercel, Netlify, Railway, or Fly.io URL is exactly what you need. Even a preview deployment URL works fine.

Go to the vibe code security scanner, enter your URL, and hit scan. The scanner fetches your site's HTTP headers, analyzes any Content Security Policy directives, checks your TLS certificate and HTTPS enforcement, looks for DNS email security records, and attempts to access commonly exposed files like .env. The full analysis runs in under 30 seconds.

Reading your scan results#

Results open with an overall letter grade from A+ to F. The grade gives you a quick read on where your app stands, but the section-by-section breakdown is where the useful information lives.

An A or A+ means all critical security measures are in place. A B grade means minor gaps exist but the risk is low. A C grade means significant issues need attention before the app handles sensitive data. A D or F means critical vulnerabilities are present and the app is not safe for production use with real users.

Most freshly vibe-coded apps land in the D to F range. That is not unusual or alarming. It just means the security layer has not been added yet.

The results are organized into sections: security headers, CSP analysis, TLS and HTTPS, DNS, cookies, and exposed files. Each finding includes a specific fix instruction. These instructions are written to be copy-pasted directly into your codebase or pasted to your AI tool. You do not need to research what the fix should be.

$ Scanning https://myapp.vercel.app...

Overall Grade: D

Security Headers
  ✗ Content-Security-Policy     MISSING
  ✗ Strict-Transport-Security   MISSING
  ✓ X-Content-Type-Options      nosniff
  ✗ X-Frame-Options             MISSING
  ✗ Permissions-Policy          MISSING

CSP Analysis
  No Content-Security-Policy header detected.
  Inline scripts and third-party resources are unrestricted.

TLS / HTTPS
  ✓ Valid certificate (expires 2026-09-14)
  ✗ HSTS not enforced on first visit

DNS / Email Security
  ✗ No DMARC record found
  ✓ SPF record present

Exposed Files
  ✗ /.env returned HTTP 200 — file is publicly accessible

Cookies
  ! Session cookie missing HttpOnly flag
  ! Session cookie missing Secure flag

The output above is a realistic example of what a newly deployed vibe-coded app looks like before any security work. Every item marked with a cross is a specific, fixable problem. The items marked with a checkmark are already in place and do not need attention.

Fixing issues using Claude Code or Cursor with MCP#

If you built your app with Claude Code or Cursor, you can connect the SiteSecurityScore MCP connector directly to your editor. MCP (Model Context Protocol) is a standard that lets AI tools call external tools and APIs directly from within a conversation, without leaving the editor or copying results back and forth.

With the connector configured, you can ask your AI to scan your site and fix issues in a single conversation. The AI calls the scanner, reads the results, and then writes the code to address each finding in your actual project files.

{
  "sitesecurityscore": {
    "type": "http",
    "url": "https://www.sitesecurityscore.com/mcp",
    "headers": {
      "Authorization": "Bearer YOUR_API_KEY"
    }
  }
}

Replace YOUR_API_KEY with an API key from your SiteSecurityScore account. Once the config is saved, your AI tool can call the scanner as a native tool.

A typical conversation looks like this: you ask "scan https://myapp.vercel.app for security issues and fix what you find." The AI runs the scan, reports back a summary of the findings, and then writes the code. For a Next.js app, it adds the security headers to next.config.js. For an Express server, it adds the appropriate middleware. For cookie issues, it finds the cookie-setting code and adds the missing flags. All in one conversation, without you needing to interpret the results or look up what each fix should be.

For the complete setup guide for Claude Code, see How to Add a Security Scanner to Claude Code with MCP. If you use ChatGPT Codex, the process is covered in How to Add a Security Scanner to ChatGPT Codex with MCP. You can also learn more about the connector at the MCP Connector product page.

Pre-launch security checklist#

Before you share your URL publicly, go through each of these checks. You do not need to complete all of them in one session, but the HIGH severity items should be resolved before the app handles real user data.

Going through this list once before launch takes about 30 minutes. The scan itself is under 30 seconds. The fixes, especially with an AI tool doing the implementation, are usually fast. Most vibe-coded apps can go from a D grade to a B grade in a single focused session.

Frequently asked questions#