by AISynq
Free · 60 seconds · no account
99% of AI-built apps have a security hole. Find yours in sixty seconds.
vibe-eval.com, 30,998 apps scanned, August 2026
Paste your address. We look at your app the way a stranger on the internet would, and give you a grade from A to F with the reason for it in plain words.
- We never write to your app
- We never store your data
- You see the grade before we ask for anything
What comes back
A grade, and the reason for it.
This is a real scan of a demonstration app, not a mock-up of a screen we have not built. Yours arrives in the same shape.
Anyone with your address can read your customers table.
48 / 100 · checked 14 of 14 · high confidence
https://example-app.com
Seaworthy · scanned
Anyone can read your customers table without logging in
criticalWe asked your database for a row using only the public key from your browser code. It gave us one.
A Stripe secret key is in the code your app sends to browsers
criticalEvery visitor downloads the file it sits in. Rotating it is the only thing that makes it safe.
Your site answers over an unencrypted connection
highTyping the address without https loads the site anyway, rather than redirecting.
Your original source code is published
mediumSource maps let anyone read your app the way you wrote it, comments included.
Two criticals cap the grade at F on their own. This one is a D because the second is a key rather than a second open table.
What it costs
The bill arrives before the warning does.
Your model key, spent by a stranger
An AI key sitting in your browser code is a key anyone can copy. They do not attack you. They just use it, at volume, and you find out on the invoice at the end of the month.
Your customer table, readable by anyone
Your app tells every visitor where your database is. If the access rules are off, the address is the whole password. Names, emails, whatever else is in there.
Payments you never received
If the webhook that hears about successful payments does not check the signature, anyone can post a fake one and get the thing they did not buy.
None of these need an attacker looking for you. They need somebody bored with a browser and your address.
What the free scan looks at
Only what any visitor to your app can already see. No login, no code, nothing installed.
Keys left in your JavaScript
Your app sends script files to every browser that opens it. We read them for keys that were meant to stay on your server. One AI-built app in twenty-three ships one.
Databases that answer strangers
We ask whether a small set of commonly named tables will return a row to somebody who is not logged in. We record that they answered and what the columns were called. Never the data itself.
Files that should not be public
Addresses like /.env and /.git that sometimes get deployed by accident and hand over everything at once.
Security headers
The handful of settings that stop your app being framed by somebody else’s site, or loaded over an unencrypted connection.
Source maps
Files that let anyone read your original code rather than the compiled version. Thirteen per cent of scanned apps publish them.
Error pages that say too much
Stack traces and version numbers in responses, which tell an attacker exactly what you are running.
What it will never do
- It never writes, changes or deletes anything in your app.
- It never stores the contents of a row. If a table answers, we record that it answered and how many rows it claimed.
- It never runs without you ticking the box to say the app is yours.
The free scan only sees what the public internet sees. It cannot read your code, so it cannot tell you whether a logged-in user can reach another user’s data. That needs the full audit.
A senior engineer reads your report, not a dashboard.
Radwan Altaf has spent twelve years building and shipping production software for DHL, AT&T, DirecTV, Accenture, the Singapore Government and Simons Group. He founded AISynq. He runs these audits himself.