What should a passive vibe coding security scan actually prove?

We’re launching Check My Vibe as a deliberately limited first-pass security tool for AI-built and vibe-coded websites.

The design constraint is simple: no login, no exploit attempts, no recursive crawling, and no stored scan history. The automated pass checks the public response, selected same-origin JavaScript, security headers, HTTPS behavior, source maps, credential-shaped strings, and a fixed set of sensitive public paths. It then hands off to a separate 36-point manual checklist for authorization, database access, dependencies, and deployment controls that a passive scanner cannot prove.

That separation matters because a clean automated result should never be presented as proof that an application is secure.

What would make this kind of first-pass report more useful without turning it into intrusive testing?

You can try the free scanner here: https://checkmyvibeapp.com/