Security scanners
VibeEval
Black-box tests a deployed app from the outside, then has a person review findings before the report is delivered.
Pricing as seen
A 14-day Pro trial is listed with no card. Paid plan prices: See site.
Checked 16 Oct 2026. Prices change. Confirm on the vendor site before you buy.
Pricing sourceUpdated
16 Oct 2026
Added
16 Oct 2026
Supported builders
These builders produce a URL or a repo you can point the scanner at. Support here means the scan does not depend on a plugin inside the builder. The product is a URL test, so the builder only matters if it can deploy a public URL.
What it is
VibeEval tests a public URL you own. Nothing is installed in the codebase. A browser session and a set of AI agents look at the deployed app, its JavaScript, its API, and third-party calls, and a human reviews findings before delivery.
The docs are explicit that localhost and private networks are refused, and that you must own the target or have written permission. Initial triage is faster than the verified report. Treat the first number as a start, not a finished test.
Best for: Someone who can deploy a public preview and wants an outside-in look with a person in the loop.
Watch-outs
- Only publicly routable URLs are accepted. A laptop localhost URL will be refused.
- You need permission to test the target. Scanning someone else's app is out of bounds.
Our take
Opinion from ShipSafeStack. Not a score, not a certification, and not a sponsorship.
The human review is the part that separates it from a purely automated URL scanner, and it also means the result is not instant. Do not scan a target you do not own. A triage score is not the verified report.