Question 1

What is vibe coding?

Accepted Answer

Vibe coding is the practice of building software applications primarily using AI coding assistants like Cursor, Claude Code, Bolt, Lovable, v0, Windsurf, or GitHub Copilot. The developer describes what they want in natural language and the AI generates the code. While this dramatically accelerates development, AI-generated code frequently ships with security vulnerabilities because AI assistants optimize for functionality, not security hardening.

Question 2

Can I try VibeSec for free?

Accepted Answer

Yes — one full assessment per domain, completely free. Same 4-phase scan, same specialist agents, same PDF reports with every finding and AI fix prompt. No credit card required, no blurred results. After your free assessment, start a 7-day free trial of VibeSec Pro ($199/mo) for unlimited on-demand scans.

Question 3

How does VibeSec Pro work?

Accepted Answer

VibeSec Pro is a $199/month subscription that gives you unlimited on-demand security assessments. Submit your domain, and VibeSec runs a 4-phase scan: reconnaissance and infrastructure fingerprinting, automated vulnerability scanning, AI-assisted specialist analysis, and manual validation. Every finding includes a severity rating, evidence, and an AI-ready fix prompt you can paste directly into Cursor, Claude Code, or any AI coding assistant. Reports are available as PDF or Markdown.

Question 4

What is a VibeSec security assessment?

Accepted Answer

A VibeSec Pro security assessment is a non-invasive external security review of your web application. We evaluate your HTTP security headers, SSL/TLS configuration, CORS policies, DNS records, and infrastructure fingerprinting — all without accessing your source code or impacting your production environment. You receive an executive summary, detailed technical findings, and AI-ready remediation prompts you can paste directly into Cursor, Claude Code, or any AI coding assistant.

Question 5

How much does a security assessment cost?

Accepted Answer

VibeSec Pro is $199/month and includes unlimited on-demand security assessments. No hidden fees, no hourly billing, no surprise charges. Your first assessment is completely free — same full report Pro subscribers get. Start a 7-day free trial for unlimited scans.

Question 6

What do I get in the report?

Accepted Answer

Your report includes three sections: (1) an executive summary with your overall security grade and risk profile, (2) detailed technical findings organized by severity with evidence and screenshots, and (3) AI-ready remediation prompts — copy-paste instructions formatted for your AI coding assistant that tell it exactly what to fix and how.

Question 7

How long does the assessment take?

Accepted Answer

VibeSec Pro assessments are on-demand — submit your domain and results are delivered in minutes, not days. You'll receive an email notification as soon as your report is ready.

Question 8

Do you need access to my source code?

Accepted Answer

No. The security assessment is entirely external and non-invasive. We evaluate your application the same way an attacker would — from the outside. We never need access to your codebase, server, or hosting dashboard.

Question 9

Is the assessment non-invasive? Will it affect my production site?

Accepted Answer

Yes, the assessment is completely non-invasive. We only make standard HTTP requests that any web browser would make — checking headers, certificates, and publicly visible configurations. There is zero risk to your production environment, your data, or your users.

Question 10

What is the difference between a security assessment and a penetration test?

Accepted Answer

A VibeSec Pro security assessment evaluates your external security posture — headers, SSL, CORS, DNS, infrastructure — without attempting to exploit vulnerabilities. A penetration test goes deeper: it actively tries to find and exploit vulnerabilities in your application logic, authentication, authorization, and data handling. Think of the assessment as a health checkup and the pentest as exploratory surgery.

Question 11

Do I need to schedule a call?

Accepted Answer

No. VibeSec is fully async — no calls, no meetings, no screen shares. Submit your domain and receive your report by email. If you have questions after receiving your report, we respond via email within one business day.

Question 12

What if you don't find any vulnerabilities?

Accepted Answer

Even a clean assessment has value — it gives you documented proof of your security posture that you can share with investors, customers, and compliance teams. That said, in our experience, every application has room for improvement. We almost always find configuration issues, missing headers, or hardening opportunities.

Question 13

Can I see a sample report before I buy?

Accepted Answer

Yes! We have a full redacted sample report at vibesecadvisory.com/sample-report showing exactly what you get: executive summary, detailed findings with severity ratings, security headers analysis, SSL/TLS review, infrastructure fingerprinting, and AI-ready remediation prompts for every finding. The sample uses fictional data but the structure, depth, and format are identical to what you receive.

Question 14

Is AI-generated code secure?

Accepted Answer

Not inherently. Research shows that a significant percentage of AI-generated code ships with security vulnerabilities. AI coding assistants optimize for functionality — making code that works — but they don't prioritize security. Common issues include missing input validation, insecure default configurations, exposed API keys, and outdated dependency patterns based on training data that may be 6+ months old.

Question 15

What are the most common vulnerabilities in vibe-coded apps?

Accepted Answer

The most frequent issues we find in AI-built applications are: missing or misconfigured security headers (CSP, HSTS, X-Frame-Options), exposed API endpoints without authentication, insecure CORS configurations that allow any origin, hardcoded secrets in client-side code, missing rate limiting on form submissions, and outdated dependencies with known CVEs.

Question 16

Should I trust my AI coding assistant's security recommendations?

Accepted Answer

With caution. AI assistants can give confident-sounding security advice that is incomplete or wrong. They may recommend deprecated practices, miss new vulnerabilities disclosed after their training cutoff, or generate headers with syntax errors that silently fail. Always verify AI security recommendations against current documentation and consider a professional review before going to production.

Question 17

How do I secure an app built with Cursor, Claude Code, or Bolt?

Accepted Answer

Start with the fundamentals: add proper security headers (CSP, HSTS, X-Frame-Options), configure CORS correctly, validate and sanitize all user inputs, authenticate your API endpoints, run npm audit and fix critical vulnerabilities, and remove any hardcoded secrets. A VibeSec Pro security assessment checks all of these and gives you AI-ready prompts to fix any issues using the same AI tools you built with.

Question 18

What is the difference between VibeSec and an automated scanner like Snyk?

Accepted Answer

Automated scanners like Snyk focus on known vulnerabilities in your dependencies (CVE matching). They're valuable but limited — they can't evaluate your security headers, CORS configuration, authentication logic, or infrastructure setup. VibeSec provides human-expert analysis of your entire external security posture, plus AI-ready remediation prompts. We find configuration issues and architectural problems that scanners miss.

Question 19

Why can't I just use AI to review my AI-generated code for security?

Accepted Answer

Using AI to review AI-generated code creates a circular dependency. The reviewer has the same training data limitations and blind spots as the generator. If the AI didn't know about a security best practice when writing the code, it won't know to flag it during review. This is especially problematic for vulnerabilities disclosed after the model's training cutoff — the 6-month gap.

Question 20

What is the "6-month gap" in AI security knowledge?

Accepted Answer

The 6-month gap refers to the delay between an AI model's training data cutoff and today. New vulnerabilities (CVEs) are disclosed daily, but your AI coding assistant only knows about threats from its training period. A vulnerability discovered last month won't appear in your AI's recommendations. This gap is where real-world attackers operate, and it's a key reason why AI-only security review is insufficient.

Question 21

Do vibe-coded apps get hacked more often?

Accepted Answer

There's no large-scale study yet, but the risk factors are clear: AI-generated code often lacks security hardening, developers using AI tools may have less security experience, and the speed of vibe coding means security reviews are often skipped. The combination of fast shipping and limited security review creates a larger attack surface than traditional development.

Question 22

What security headers does my website need?

Accepted Answer

At minimum, every web application should have: Content-Security-Policy (CSP) to prevent XSS attacks, Strict-Transport-Security (HSTS) to enforce HTTPS, X-Frame-Options or CSP frame-ancestors to prevent clickjacking, X-Content-Type-Options set to 'nosniff', and Referrer-Policy. Our assessment checks all of these and provides copy-paste configurations for your specific setup.

Question 23

How do I add a Content Security Policy?

Accepted Answer

Add a Content-Security-Policy header in your hosting configuration. For Cloudflare Pages, use a _headers file. For Vercel, use vercel.json. For Nginx, add it to your server block. Start with a restrictive policy like "default-src 'self'; script-src 'self'" and expand as needed. Avoid 'unsafe-inline' and 'unsafe-eval' — they defeat the purpose of CSP. Our report includes a CSP configuration tailored to your application.

Question 24

What is HSTS and why does it matter?

Accepted Answer

HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS when connecting to your site, preventing SSL stripping attacks and accidental HTTP connections. Without HSTS, a user's first visit could happen over insecure HTTP, exposing them to man-in-the-middle attacks. Add the Strict-Transport-Security header with a max-age of at least one year and the includeSubDomains directive.

Question 25

How do I check if my API endpoints are properly authenticated?

Accepted Answer

Test each API endpoint without authentication tokens — if you get data back instead of a 401/403 error, the endpoint is exposed. Check that authentication is enforced on every route (not just the frontend), verify that tokens expire and can be revoked, and ensure sensitive operations require re-authentication. A VibeSec Pro assessment includes comprehensive API authentication testing.

Question 26

What should I do if npm audit shows vulnerabilities?

Accepted Answer

Run 'npm audit fix' to auto-fix compatible updates. For breaking changes, evaluate each vulnerability: critical and high severity issues in production dependencies should be fixed immediately. Low severity issues in dev dependencies are lower priority. If a dependency has no fix available, consider finding an alternative package. Note that npm audit catches known CVEs but misses configuration issues, logic flaws, and vulnerabilities in your own code.

Frequently asked
questions

About the Service

About AI/Vibe Coding Security

Technical Questions

Still have questions?

Frequently askedquestions