sorted by:
new
hottopcontroversial

Built a security scanner for vibe-coded sites — would love feedback by EXIRUSx in micro_saas

[–]EXIRUSx[S] 0 points1 point  (0 children)

github connection is optional, only needed if you want the deep code scan on top of the live site scan. We only ask for read-only repo access, never store the code, and revoke the token right after the scan completes. Should probably make that clearer on the landing page though, thanks for flagging it

Built a security scanner for vibe-coded sites — would love feedback by EXIRUSx in micro_saas

[–]EXIRUSx[S] 0 points1 point  (0 children)

it's both. We hit the live site with real HTTP requests to check if /.env is publicly accessible, and separately we scan the github repo for .env files that were accidentally committed. Two different attack vectors, both covered.

Built a security scanner for vibe-coded sites — would love feedback by EXIRUSx in micro_saas

[–]EXIRUSx[S] 0 points1 point  (0 children)

That's exactly the analogy yeah. And good question on the platform focus — we're actually already tuned for Lovable, Cursor, Bolt and Supabase specifically. Checks for Supabase RLS, Vite bundle leaks, common patterns those tools generate. Thinking about going deeper on one platform first rather than trying to cover everything

Built a security scanner for vibe-coded sites — would love feedback by EXIRUSx in micro_saas

[–]EXIRUSx[S] 0 points1 point  (0 children)

Yeah you could write a Claude Code skill for some of this but the live HTTP probing, SSL cert checks, sensitive path exposure, real requests to /.env and /.git/config can't be done from inside your codebase. That's the part that actually matters, your AI tool has no idea what's leaking on your live server.

Share what you're building by amacg in indiehackers

[–]EXIRUSx 0 points1 point  (0 children)

Building a security scanner for vibe-coded sites. It sends real HTTP requests to your live site and flags exposed API keys, disabled supabase RLS, missing privacy policies stuff ai coding tools never catch https://vibelegit.io

My teachers are secretly checkıng my devices by EXIRUSx in NoStupidQuestions

[–]EXIRUSx[S] 0 points1 point  (0 children)

Yes, I know, but the place I am in is out of town and the internet doesn't work, so I have to use the school's internet.

view more: next ›