Public surface
Things a clean anonymous session can verify without source-code access.
- Security headers and frame protection
- Public source maps and build artifacts
- Secret-shaped strings in client bundles
- CORS, cookies, and HTTPS posture
> ai app security scan
AI app security scan before launch
An AI app security scan should first test what an outside visitor can reach: response headers, exposed build files, public source maps, CORS, cookies, client-bundle secrets, platform metadata, and unauthenticated API responses. Use that public-surface scan before you share the URL, then separately review code-level authorization, payment logic, and tenant isolation.
> scan map
What this scan should cover
Open data signals
Signals that an endpoint or storage layer may be reachable without the intended session.
- Structured JSON from logged-out requests
- Supabase REST or GraphQL exposure signals
- Public storage bucket objects
- Verbose errors and stack traces
Manual follow-up
Checks a public scan cannot honestly prove from the outside.
- Tenant isolation between two real accounts
- Subscription entitlement enforcement
- Webhook signature verification
- Admin role boundaries
> where vibecodeguard fits
Public-surface evidence before launch.
VibeCodeGuard is the first pass for a deployed AI-built web app: paste the public URL, get ranked findings with evidence, then use the report to decide what must be fixed before launch.
> limits
What a public scan cannot prove
- It is not a penetration test and does not log in as multiple users.
- It does not replace source-code review for business logic, payments, or authorization paths.
- A clean public-surface scan is one launch signal, not proof the app is secure.
> sources
References used for this page
- WIRED: thousands of vibe-coded apps exposed data ↗Industry evidence that public AI-built app exposure is a real launch risk.
- Google Search Central: structured data ↗Reference for JSON-LD and structured data implementation.
- Google Search Central: sitemaps ↗Reference for making sitemap URLs discoverable to search engines.
> faq
Direct answers
What should I scan first in an AI-built app?
Start with the public URL. Check headers, exposed files, source maps, CORS, cookies, client-side secrets, and unauthenticated data responses before you review deeper account-specific logic.
Can an AI app security scan prove my authorization is correct?
No. A public scan can flag reachable unauthenticated routes, but tenant isolation and role enforcement require account-aware testing or code review.
When should I run the scan?
Run it before sharing the production or staging URL, after major AI-generated changes, and again after fixing any high or critical findings.