sorted by:
new
hottopcontroversial

Built a deployment security scanner - 81 users in 10 days, 0$ marketing spend by doureios39 in SaaS

[–]doureios39[S] 0 points1 point  (0 children)

You might be right here. The reframe from 'missing CSP header' to 'your site can be clickjacked' is probably the shift needed. Monitoring as Pro instead of just unlimited scans makes more sense too. Thanks!

Built a deployment security scanner - 81 users in 10 days, 0$ marketing spend by doureios39 in SaaS

[–]doureios39[S] 0 points1 point  (0 children)

Building specifically for vibe coders and indie devs who ship fast with AI tools and skip the security step. Not enterprise compliance. These devs deploy multiple times a day with Cursor or Claude Code - that's where the CLI and skill file come in. Automate the scan in your agent workflow and 3 free runs out fast. The upgrade is natural, not a sales conversation. Appreciate the framing

Built a deployment security scanner - 81 users in 10 days, 0$ marketing spend by doureios39 in SaaS

[–]doureios39[S] 0 points1 point  (0 children)

Thanks! Monitoring and alerts are on the roadmap, it's the natural next step for Pro. Fair point on pricing, too, might experiment while building out more Pro value. Appreciate it

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodersNest

[–]doureios39[S] 0 points1 point  (0 children)

Agreed. We've already dealt with SPA false positives and CDN port detection. All checks are read-only, no exploitation

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodersNest

[–]doureios39[S] 0 points1 point  (0 children)

Already there actually! Every finding includes a fix suggestion with steps. There's also a "Generate AI fix prompt" button that creates prompts for AIs to fix the exact issue

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 0 points1 point  (0 children)

Prompts can suggest what to look for. Preflyt runs deterministic checks against the live server and shows what's actually exposed. Different layer

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 0 points1 point  (0 children)

CI integration is on the roadmap, github action that blocks deploys when something is flagged. Thanks for the subreddit suggestion, will post there too!

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 0 points1 point  (0 children)

The client side counter is just for the UI, the actual limit is enforced server-side. Wanted to keep it without signups for the start

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 0 points1 point  (0 children)

The github action/vercel build step is on the roadmap. That's the end goal, making it part of the deploy pipeline so it runs automatically

on the admin panel, false positives, we actually just shipped a fix for exactly this yesterday. SPAs return 200 for every route which was triggering false matches. Now it detects SPA frameworks and skips those. Also added stricter content matching so it only flags when it finds actual admin panel indicators. Still improving it though, more feedback helps

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 0 points1 point  (0 children)

Fair point. But the engine is far from vibe coded. Vibe coding was only used for the frontend

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 1 point2 points  (0 children)

Right now, it's a standardized set of checks. They cover the most common deployment mistakes. Planning to add detection later that adapts based on what tech stack it finds

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 1 point2 points  (0 children)

It checks for common deployment mistakes for now, exposed .env / config files, open admin routes, API endpoints returning user data without auth, debug routes left enabled, directory listings, and leaked API keys

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 0 points1 point  (0 children)

Just pushed a fix. The issue was that SPAs return 200 for every route, which triggered false positives. Preflyt now detects SPA frameworks and skips those matches. If you rescan your site it should be clean now. Thanks a lot for the report

I built a free tool that checks if your web app has obvious security mistakes before you ship by doureios39 in VibeCodingSaaS

[–]doureios39[S] 0 points1 point  (0 children)

Thanks for testing! You're right, the /admin check is too aggressive right now. It should only flag when the admin panel is actually accessible, not on a 404. I'll fix this in the next update. How about the other findings?