Perfai Security

Find & fix live vulnerabilities in Vibe Apps with 1-prompt.

4.3•3 reviews•

687 followers

Find & fix live vulnerabilities in Vibe Apps with 1-prompt.

4.3•3 reviews•

687 followers

Visit website

Testing and QA software

•

Security software

Autonomous access control security for Vibe-coded apps. Our platform finds and fixes live vulnerabilities in your vibe-apps built on Replit, Lovable, Claude Code, Cursor, and other AI-coding tools. 1-prompt makes your app production-ready in minutes without requiring security expertise.

Perfai Security Reviews

Name: Perfai Security
Rating: 4.33 (3 reviews)

The community submitted 3 reviews to tell us what they like about Perfai Security, what Perfai Security can do better, and more.

4.3

Based on 3 reviews

Review Perfai Security?

Reviews

Most Informative

Founder Reviews

Other Reviews (3)

•51 reviews

What's great

Building web apps rapidly with prompt based tools like Lovable and Claude Code shifts the development bottleneck from writing logic to architecture verification. Perfai Security addresses this shift perfectly by acting as an automated red team that requires zero initial source code access. The platform doesn't just surface security vulnerabilities like IDOR or broken object level authorization, its Fix Agent actively generates precise, drop in patches that can be instantly piped back into an AI editor framework to close critical endpoints before deployment.

What needs improvement

The autonomous testing pipeline runs thousands of API validation scripts smoothly, but the default credit allocations on the entry level testing framework run out quickly when evaluating deeper application routes. High velocity developers running multiple code iterations over a short development cycle can exhaust the base scanning limits before fully configuring their target security profiles. Expanding the trial credit threshold or introducing temporary sandbox tokens for sandbox environments would make extensive regression testing much easier to sustain.

vs Alternatives

I evaluated traditional SAST and DAST penetration testing suites alongside basic script frameworks. Standard static code analysis utilities are poorly optimized for the iterative, velocity driven nature of vibe coding, often requiring heavy environment setups and surfacing endless false positives that derail development flow. I chose Perfai Security because it treats the live application endpoint as a black box simulation, replicating real world attack scripts autonomously while providing immediate actionable refactoring paths.

Ratings

Ease of use

Reliability

Value for money

Customization

Report

22 views1mo ago

•30 reviews

What's great

The platform addresses the critical security void left by rapid, AI-driven prototyping—colloquially termed "vibe coding"—by implementing an autonomous, code-free black-box testing harness. Composed of a three-agent system (Vision Agent, Security Agent, and Fix Agent), Perfai operates without initial source code access, requiring only a target staging or production URL. The Vision Agent maps frontend paths and extracts multi-role user schemas, allowing the Security Agent to immediately fire over 20,000 contextual exploit mutations targeting high-risk logic flaws like BOLA/IDOR and broken access control. The absolute differentiator is its self-healing capability: the Fix Agent packages the failure context and pushes precise remediation patches directly into the developer's agentic IDE like Cursor, Claude Code, or Lovable to verify the loop closes natively.

What needs improvement

The dependency on automated browser manipulation loops presents a noticeable bottleneck when scanning applications protected by strict rate-limiting firewalls or complex multi-factor authentication (MFA/SSO) gateways. Firing thousands of concurrent test vectors can quickly trip standard DDoS blocks, necessitating manual IP whitelisting or custom proxy setups to allow full scanning depth on production infrastructure. Additionally, while the Fix Agent provides brilliant contextual remedies for isolated endpoint flaws, it addresses symptoms rather than underlying software designs; merging multiple auto-generated patches without senior structural oversight risks introducing convoluted dependency layers or unindexed query structures over time.

vs Alternatives

I’ve evaluated traditional Static Application Security Testing (SAST) and Dynamic Testing (DAST) tools like SonarQube, Burp Suite, and OWASP ZAP, alongside specialized modern pentesting platforms like ZeroThreat and Beagle Security. While SAST packages analyze raw files for generic code patterns, they consistently miss complex multi-step logical authorization bypasses, whereas legacy DAST scanners demand massive upfront manual config mapping and struggle to navigate single-page apps (SPAs) dynamically across distinct authenticated user permissions. I opted for Perfai Security because it runs continuous, multi-role behavioral exploitation loops that directly mirror modern agentic development velocities without requiring specialized security expertise or stalling production branches.

Ratings

Ease of use

Reliability

Value for money

Customization

Report

28 views1mo ago

•77 reviews

What's great

Been going back and forth with Intesar in the comments about how deep the "fix" actually goes, and the answer is deeper than I expected. It's not just flagging vulnerabilities, it generates a ready-to-run patch for your code agent and you can approve or reject before anything actually changes. For vibe-coded apps where auth/access-control gets skipped because nobody explicitly decided on it, having something surface that as a decision point is genuinely useful. The drift detection so it keeps testing as the app changes is a nice touch too, most scanners are one-and-done.

What needs improvement

Would like to see the review step made a bit more visible before a fix gets applied - right now it's easy to just hit "Fix All" without fully reading what's changing in a data-layer rule versus API authz logic. Also wouldn't mind a summary of what a fix touched after the fact, for cases where you approved in a hurry.

Ratings

Ease of use

Reliability

Value for money

Customization

Report

22 views1mo ago