Built it with AI?
Let's check what it missed.
AI tools like Cursor, Lovable, Bolt, Copilot and ChatGPT make it easy to ship a website, app, CRM or codebase without a seasoned developer — and easy to ship the mistakes they leave behind. Vulnscape scans what you built and finds the vulnerabilities and errors, big or small, then explains the fix in plain English.
Why it matters
AI writes code fast. It doesn't review it.
The same shortcuts that make AI-assisted building quick are the ones that get systems breached. These are the mistakes we see most often in AI-generated projects — and every one of them is something Vulnscape checks for.
Code that looks right but isn’t
SQL queries built from strings, API keys pasted into source, missing auth checks on routes, weak crypto. It runs fine in the demo — until someone pokes at it.
Defaults nobody changed
Missing security headers, insecure cookies, open admin logins, no rate limiting, exposed ports and debug endpoints. Boilerplate ships with the gaps included.
Things nobody reviewed
Dependencies with known CVEs, secrets left in shared AI chats and gists, reused passwords, expiring certificates. Small mistakes that turn into big incidents.
What we check
Every layer of what you shipped
Point Vulnscape at your website, your code, your dependency list, your passwords, your server or your AI/GPU stack. Each scanner collects hard evidence; Vulnscape AI turns it into findings ranked by severity, with the fix.
Code analysis
Static review of source for SQL injection, XSS, hard-coded secrets, weak crypto and insecure patterns — a deterministic pre-pass feeds Vulnscape AI.
Website scanning
From one URL: same-origin crawl, security headers, cookies, TLS, forms and upload gaps — plus authorized XSS/SQLi probes, Nuclei, SQLMap, default-admin and HTTP rate-limit checks.
Dependency CVEs
Parse package.json, lockfiles or requirements.txt and match pinned versions against the OSV.dev vulnerability database.
Password audit
Strength and entropy scoring plus Have I Been Pwned k-anonymity breach checks. Raw passwords never leave the scan — Vulnscape AI only sees metrics.
Network scanning
TCP port probes, DNS records, SPF/DMARC email posture and deep TLS certificate inspection — SSRF-guarded and authorization-gated.
AI/GPU infra exposure
Find exposed, unauthenticated AI/ML services on your servers and GPU pods — Ray dashboards (ShadowRay), Jupyter, Ollama, ComfyUI, vLLM, Triton and MLflow, plus open Docker/Kubernetes APIs. Non-destructive checks, authorization-gated.
Secret-leak scanner
Paste a public share link — an AI chat transcript, GitHub gist or paste — and Vulnscape finds leaked API keys, private keys and wallets. Optional read-only validation shows which keys are still live.
How it works
From “it works” to “it's safe” in minutes
Point us at what you built
Paste your code, a URL, a dependency file, a host or a shared link. Confirm you are authorized, then run the scan — deep website scans run in the background.
Get a plain-English report
Vulnscape AI turns raw scanner evidence into findings ranked by severity — what it is, why it matters, how to fix it — plus a 0–100 risk score.
Re-check after every change
Mark targets as monitored and re-scan them whenever you ship. New issues become alerts; export or share password-protected reports with clients or stakeholders.
Alerts on change — on your schedule
Mark targets as monitored, then click “Check for new alerts” whenever you want them re-scanned. New findings, risk increases and failed scans surface as alerts, with optional email and Slack notifications. Nothing runs in the background, so usage stays predictable.
Find prospects on demand
AgencyPull companies that are actively hiring engineers from seven public job boards, let Claude qualify each one as a security prospect, and file them straight into your Leads CRM — one click, whenever you need pipeline.
See it in action
From “pick a scanner” to “here's the fix”
Choose a scanner, point it at what you built, and get a prioritized report with plain-English remediation — plus an assistant you can ask follow-up questions, grounded in your findings.
Vulnscape AI
Findings you can act on — without a security team
Scanners gather headers, ports, CVEs, password metrics, injection probes and code signals. Vulnscape AI explains what each one means for your system, scores the risk, and writes the fix — often something you can paste straight back into your AI coding tool. Ask follow-up questions in the console. Included in every plan.
Sign in to try itVulnscape AI — powered by Claude
Every scan's evidence becomes severity-scored findings with copy-paste remediation — not raw scanner noise.
Ask Vulnscape AI
Chat about a single scan or your whole portfolio: what to fix first, how to remediate, what a risk score means.
Alerts on change
Re-scan monitored targets on demand. New findings, risk increases and failed scans land in Alerts, with optional email and Slack notifications.
Pricing
Two plans. Clear upgrade path.
Ops is for teams checking their own AI-built systems. Agency is for studios and freelancers who ship for clients — it adds the Leads CRM, on-demand lead finder and team seats.
Vulnscape Ops
Security suite
For teams shipping AI-built websites, apps and code: every scanner, plain-English findings and fixes from Vulnscape AI, re-scans and alerts.
- Code, web, dependency, password & network scans
- Secret-leak scanner for shared AI transcripts, gists & pastes
- Vulnscape AI (powered by Claude) on every finding
- Re-scan monitored targets on demand + alerts on change
- Vulnscape AI assistant (portfolio + per-scan chat)
- HIBP breach checks & OSV.dev CVE matching
- Upload / file-type gap checks on web scans
- Authorized active probes (XSS / SQLi / HTTP rate-limit check)
Vulnscape Agency
Leads + team
For studios and freelancers building with AI for clients: run client scans, find prospects on demand, and track outreach.
- Everything in Vulnscape Ops
- Leads CRM for inbound + outbound prospects
- On-demand lead finder across 7 public job boards, qualified by Claude
- Save scan contacts as leads
- Pipeline statuses: new → contacted → qualified → won
- Team seats for operators under your org
- Priority support for client engagements
Online checkout is not enabled yet — contact us to subscribe. Sign in
Get in touch
Request a security audit or quote
Launched something with AI and want a human to look it over before customers do? Tell us what you built — website, app, CRM, integration or codebase — and we’ll come back with scope and pricing for a hands-on review. Prefer self-serve? Subscribe in the pricing section above.
- →Application & website security audits
- → Code review with Vulnscape AI-assisted reporting
- → Platform quotes for Ops / Agency seats
FAQ
Straight answers
We built our product with Cursor / Lovable / Bolt / ChatGPT — is this for us?+
Yes, that is exactly who Vulnscape is for. AI tools are great at producing working software and poor at reviewing it. Vulnscape checks the website, code, dependencies and server you ended up with for the security mistakes an inexperienced developer would miss, and tells you how to fix them.
Do I need to be technical to use it?+
No. You paste a URL, upload code or a dependency file, and read the report. Vulnscape AI explains every finding in plain English with a concrete fix — usually something you can hand straight back to your AI coding tool or your developer.
Does it find small mistakes as well as serious vulnerabilities?+
Both. Findings range from critical (SQL injection, leaked API keys, default admin logins) down to informational (a missing header, a version banner, a weak cookie flag). Everything is ranked so you know what to fix first.
What’s included in Vulnscape Ops?+
All six scanners (code, website, dependencies, passwords, network, secret leaks), Vulnscape AI powered by Claude, on-demand re-scans of monitored targets, alerts, reports, share links and the AI assistant.
What is Vulnscape Agency?+
Everything in Ops plus a Leads CRM for inbound requests and outbound prospects, an on-demand lead finder that pulls companies hiring engineers from public job boards and qualifies them with Claude, and team seats. Built for agencies and freelancers selling security work.
Does anything run automatically in the background?+
No. Scans, re-scans and lead searches only run when you start them. Mark a target as monitored and click “Check for new alerts” whenever you want it re-scanned — you stay in control of usage.
Can you run a security audit for my company?+
Yes. Use the audit / quote form on this page with your name, email, phone and company. We’ll follow up with scope and pricing.
How do I get a login after I pay?+
Enter your email on the pricing section, complete Stripe Checkout, and Vulnscape creates your account automatically. A temporary password is emailed to you — then sign in at /login. Use “Forgot password” anytime to reset.
Is this only for authorized testing?+
Yes. Website and network scans require an explicit authorization confirmation, and localhost / private IP ranges are blocked. Only scan systems you own or have written permission to assess.
How does the AI handle passwords?+
Passwords are checked locally for strength and via HIBP’s k-anonymity API (hash prefix only). Vulnscape AI receives structural metrics — never the raw secret.
Monthly or annual?+
Ops: $299/month or $2,999/year. Agency: $1,299/month or $12,999/year. Same features within each plan either way.
Find what your AI missed.
Run your first scan in minutes. Vulnscape Ops is $299/mo or $2,999/yr.