I'm surrounded by vibe coders. My friends, other developers I know online, people in communities I'm part of. They're all shipping fast with Cursor, Copilot, and Windsurf, building genuinely impressive stuff. But almost none of them think about security. I work in information security, so I started poking at their sites out of curiosity. Missing security headers, wide-open CORS policies, exposed secrets in page source, cookies without basic flags. The same issues, over and over. I kept telling them what to fix, but the advice didn't stick because there was nowhere they could check for themselves. The existing scanners are either too expensive, too complex, or just give you a pass/fail with no explanation. So I built Hexora. Paste a URL, get a full security report in under 15 seconds. Every finding comes with evidence showing exactly what's wrong, and an AI fix prompt you can copy straight into Claude or Cursor to generate the patch. It's still early. Right now it runs 7 passive scanners (SSL/TLS, headers, CORS, cookies, DNS, exposed secrets, tech fingerprinting). Active testing like XSS and SQL injection is on the roadmap. Free tier gives you 3 scans a month with real results, no credit card. I'd love your feedback on what to build next.

Hexora

Know your site is secure

Know your site is secure