The problem
Vibe-coding ships fast — and ships the bugs with it. Roughly 45% of AI-generated code introduces an OWASP Top 10 vulnerability, and AI-written code carries about 2.74× the vulnerabilities of human-written code (Veracode, 2025). Founders shipping AI-built MVPs have no cheap, fast way to know what’s actually broken, and generic scanners just hand back a PDF list nobody ever acts on.
What we built
Vibecoded Scanner. Drop a public GitHub URL or a zip of your codebase and it audits the security, secrets, and obvious quality holes — then hands back a folder of paste-ready prompt files for Claude Code or Cursor that actually apply the fixes. Each prompt names the file, the line, the before/after snippet, and the verification command, so an agent does the work and you stay in control of every diff. A free preview runs against the riskiest file it can find and returns one sample finding plus a price quote — no signup — the full scan is a one-time payment from $5, and your uploaded code is deleted after 24 hours.
How we shipped it
A Laravel + Inertia/React front end with a Python sidecar worker running the Anthropic Agent SDK pipeline, queued through Horizon and billed with Stripe Cashier, deployed on an AWS box we run. Built to understand the stacks vibe-coders actually ship — Laravel, Next.js, React, Vue, Django, FastAPI, Flask, Node, Ruby, Python.
Outcome
Vibecoded Scanner is live in production — and it’s one of Flipvo’s own products. Proof that we build the same AI-backed, owned-infrastructure tools for ourselves that we build for clients: no SaaS rent, no vendor lock-in, the code and the box are ours.
