Tines The single, secure environment for agents, apps, and automations.
Autonomous access control security for Vibe-coded apps. Our platform finds and fixes live vulnerabilities in your vibe-apps built on Replit, Lovable, Claude Code, Cursor, and other AI-coding tools. 1-prompt makes your app production-ready in minutes without requiring security expertise.
Dropping a major upvote, qq does the security agent test for complex injection flaws (like SQLi or NoSQL injection) alongside the broken object-level access controls? congrats 👏 @qutub_syed
Perfai Security
Really appreciate the kind words,@vikramp7470 !!
Our access control testing platform compliments DAST / SAST testing tools that already test for injection flaws. And so as to not compete, but rather ensure the un-addressed majority of threat categories are secured against, we built Perfai Security around access control vulnerability testing.
@qutub_syed Thanks for raising this, all the best for your launch🙌
Release AI
@vikramp7470
Thanks for the upvote!
Straight answer: no, we don't run injection tests like SQLi or NoSQL injection. That's by design. Injection attacks can damage a live app's database, logs, and third-party integrations. We built Perfai to be production-safe, so we stay away from that category on purpose.
Our focus is access control: BOLA, broken role permissions, and data exposure across UI, API, and data layers.
Our agents chain requests across endpoints and roles to find the gaps that single-request scanners miss. That's where most real breaches happen, and it's safe to test on live apps.
For injection coverage, we pair well with a code scanner or a scheduled pentest. Think of us as the layer that covers what those tools can't see at runtime.
Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!
This launch caught my eye since every other product is vibe-coded now sometimes without even involvement of a technical team member. However, for teams with devs, can developers customize scan depth for staging versus production environments?
Perfai Security
@divya_kothari1 great question, and yes. You run different profiles per environment. You can go deep and aggressive in staging with seed test tenants, exercise state-changing and destructive attack paths, full-matrix coverage... because nothing's at risk. On production it runs in a safe, non-destructive mode (read-only checks, no mutating actions) so always-on monitoring never touches live data.
Release AI
@divya_kothari1
Thanks! You're right, so many apps ship now with no security review at all. That's exactly who we built this for.
For teams with devs, yes, there's room to tune things. You can set up separate apps in Perfai for each environment, so your staging and production scans run with their own settings, credentials, and roles. Since Perfai is production-safe by design (no injection attacks, test accounts only, no real data touched), you can run full-depth scans on production without worry. That's a big difference from regular pentesting.
Devs also get detailed findings with the exact request chains that triggered each issue, so fixes are fast.
Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help getting your team's apps set up? Just reach out. Happy to help!
Congrats! Is Perfai Security looking at the running app, the codebase, or both? The “live vulnerabilities in Vibe Apps” wording makes me curious about where it plugs into a developer workflow, especially for teams using AI agents or vibe coding tools to ship fast.
Perfai Security
Much appreciated!! @crystalmei Perfai Security looks at the running app from the URL you give it. That's exactly what "live vulnerabilities" means. We test the deployed, running system the way an attacker actually hits it, not static source analysis, andso we need zero codebase access to find issues. Where it plugs into your workflow is the fix side. The findings flow back through an MCP server (perfai-mcp-server) you drop into your IDE (Cursor, VS Code, Claude Code…), and into CI/CD via a GitHub Actions step so every deploy auto-re-tests.
Release AI
@crystalmei
Thank you!
We test the running app, not the codebase. That's a deliberate choice. Code scanners can't see runtime behavior, like an auth gap that only shows up when requests happen in a certain order, or a role that can reach data it shouldn't. Those bugs live in the running app, so that's where we test.
It also makes setup dead simple: just enter your app URL. No repo access, no CI config, no agents to install. That fits vibe coding perfectly, since the code changes constantly and often nobody's reading it anyway. Ship your app, drop the URL in, and re-scan after big updates.
Our agents test across UI, API, data, and roles, so you get full app coverage no matter what tool wrote the code.
Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!
Hi Qutub Syed, nice idea and the site looks good, I like the “test a live app by URL” approach, especially for small builders who don’t have a security team.
I tried entering my app URL and clicking “Test now”, but nothing seemed to happen on my end. I may be missing a step, or it could be a browser issue. Just wanted to flag it in case it helps with the launch feedback.
Perfai Security
@elsedes really appreciate you trying it out and flagging that. Team's already looking into it.
Perfai Security
@elsedes Here's an update: You didn't miss a step.. we had a security policy on our end that was blocking the "Test now" request. It's fixed now, so after a quick refresh, give it another try and you should go straight into the scan.
@atefa7med Great, glad it helped! I’ll give it another try. Good luck with the rest of the launch.
Perfai Security
@elsedes Thanks, appreciate it!
Most of my codebase was written with AI coding agents, so security is honestly the thing I think about the most. Product logic I can verify just by using the app, but auth edge cases never show up that way. One question, when the fix agent ships a patch, do I get to review it before it lands? A one prompt fix sounds great until it touches something load bearing :) Congrats on the launch!
Perfai Security
@henry_s_jung Yes, exactly. You always review the fix before anything changes.
When the Fix Agent generates a patch, it doesn't touch your code directly. It sends the suggested fix, along with the full vulnerability context, to the AI coding assistant you're already using (Cursor, Claude Code, Replit, and others).
You review it, make any changes you want, and decide whether to apply it. Nothing changes until you approve it.
Perfai then re-runs the exact exploit to confirm the issue is actually closed. It's designed to give you the speed of AI generated fixes while keeping you in control.
Try it free at perfai.ai
Release AI
@henry_s_jung
Thank you! And you nailed the exact problem: you can verify product logic by clicking around, but auth edge cases hide until someone hunts for them.
Great question on the Fix Agent. Yes, you review before anything lands. The agent generates the patch and shows you exactly what it changes and why, but you stay in control of what ships. Nothing touches your app behind your back. We agree a one-prompt fix should never blindside something load bearing :)
So the flow is: we find the issue, show you the exact request chain that triggered it, generate the fix, and you approve it. Fast, but never reckless.
Try it free at perfai.ai and get a full pentest-style report of your app. We're giving away 50% discount codes for the launch too. If you need extra credits or help onboarding, just reach out. Happy to help!
@intesar_mohammed1 That's the right call, showing the patch before it ships is exactly what I'd want. Congrats again on the launch, and good luck with the rest of the week. Might run my own app through it before Tuesday :)
Release AI
@henry_s_jung
Thank you! And yes, please do run your app through it before Tuesday. Just paste your URL at perfai.ai and the free tier will get you a full test with a pentest-style report.
Use code PHLAUNCH50 if you want 50% off a paid plan. And if you hit any snags or want extra credits, just message me. I'd love to hear what it finds!
Perfai Security
@ridhwikvinod You're pointing at the part we care about most. Verification isn't an afterthought, it's a core part of the workflow.
Once a fix is applied, Perfai re-runs the original exploit to make sure that specific issue is actually gone. We don't consider a vulnerability fixed until the attack no longer works.
We also re-map and re-test the application after every change. That's important because an AI generated fix can solve one problem while unintentionally introducing another. The re-test is there to catch exactly that.
The end result is a clear verdict for every finding, backed by proof instead of assumptions.
Feel free to try it.. it's free at perfai.ai
Release AI
@ridhwikvinod
Thank you! And great point. An AI fix without verification is just more vibe code.
Yes, we re-test after every fix. The agent re-runs the exact request chain that triggered the vulnerability to confirm it's closed. And since re-scans only need your app URL, running a full scan after patching is one click, so you can confirm the fix didn't open a new hole somewhere else.
You also review every fix before it ships. The agent shows you what it changes and why, so nothing load bearing gets touched blind.
That's the loop: find, fix, verify. Not just find and hope.
Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!
Release AI
Hey ProductHunt! 👋 Intesar here — CEO of Perfai Security.
This is my third company (DCHQ was acquired by HyperGrid and APIsec), and out of everything I've built, this is the one that keeps me up at night in a good way — because the timing is so obviously right.
Here's the thing about vibe coding that most people miss: the AI coding tools are incredible at making an app look and function like a real product in a few hours. What they're not good at is remembering that "User A shouldn't be able to see User B's invoices" is a rule that has to be enforced in three separate places — the UI, the API, and the database — every single time you ship an update. Nobody's shipping blind on purpose. They just don't have a security team checking access control on every prompt-to-deploy cycle, and honestly, neither did I on my first two companies until it hurt.
So we built Perfai Security as a pre-launch security testing platform for exactly this moment — the gap between "it works on my screen" and "it's live with real users." Paste a URL, our agents map your app, attack its access controls the way a real bad actor would, and hand your AI coding tool (Cursor, Replit, Lovable, Claude Code, whatever you're using) the exact fix — before you ship, not after someone finds it for you. They keep watching every future deploy too, so regressions don't sneak back in. No security background required on your end.
Huge credit to the team who actually built this: Hai, Dr. Abdullah (engineering), Dr. Habeeb (AI), Ghouse (customer success), and Qutub, who wrote the comment above and has been carrying GTM on his back.
If you're vibe-coding anything that touches real user data, I'd genuinely love for you to run it through Perfai Security and tell me what you find (or what we got wrong). I'm in the comments all day — ask me anything about the product, the roadmap, or what "6,000+ access controls in a small app" actually means in practice.
Thanks for checking us out. Build fast, ship safe. 🚀
— Intesar CEO, Perfai Security (perfai.ai)