Framer AI AgentsDesign and publish professional sites with AI
Autonomous access control security for Vibe-coded apps. Our platform finds and fixes live vulnerabilities in your vibe-apps built on Replit, Lovable, Claude Code, Cursor, and other AI-coding tools. 1-prompt makes your app production-ready in minutes without requiring security expertise.
Nas.com
Does Perfai support authentication providers like Clerk, Auth0, or Supabase Auth out of the box?
Perfai Security
@nuseir_yassin1 yes! Because we test black-box from your app's URL, we authenticate through your real login flow using the test credentials you provide for each role. This way, Clerk, Auth0, Supabase Auth and the rest all work. We meet your app wherever it lives instead of needing a separate integration per provider. If you've got a specific setup in mind, let us know and we can confirm the exact flow.
Would genuinely love to have you run something through it.
Release AI
@nuseir_yassin1
Great question! We're auth agnostic. If a typical user can sign in to your app, our agents can too. Clerk, Auth0, Supabase Auth, custom logins, all work out of the box. Our Vision Agent handles the sign-in flow the same way a real user does, and it even signs up its own test accounts if your app supports sign-up.
The only limitation right now is MFA or OTP beyond email. Email-based OTP works fine, but codes sent to phones or authenticator apps aren't supported yet.
Once in, we run full access control testing across UI, API, data, and roles, with drift detection catching new gaps as your app changes.
Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!
TestMu AI
How well does Perfai handle multi-tenant SaaS applications with complex permission hierarchies?
Perfai Security
Hi! This is our home turf @syed_shayanur_rahman Multi-tenant SaaS is where access control gets brutal, and it's what we test hardest. The Vision Agent builds a per-tenant identity map with every role across your hierarchy (org → workspace → team → resource, plus nested roles and inherited/overridden permissions) and the Security Agent then attacks on two axes: horizontal being classic cross-tenant isolation breaks and vertical being whether a member can escalate to admin/owner inside a tenant. It reasons over the effective permission, not the declared one, so inheritance quirks and role-override edge cases get exercised. Cross-tenant leakage is the highest-severity class we hunt.
Release AI
@syed_shayanur_rahman
Great question. Multi-tenant SaaS is honestly where Perfai shines, because cross-tenant data leaks are the scariest access control failures out there.
Our agents map your app's roles, data types, and actions, then test the combinations. That includes tenant boundaries: can a user in Company A reach Company B's data through a direct API call, a shared object ID, or a side door the UI never shows? Those are exactly the bugs that hide in complex permission hierarchies, and no single-request check finds them.
For hierarchies like org admin, team admin, member, and viewer, we prove what each level can and cannot reach across UI, API, and data. The agents sign up their own test accounts where possible, and you can add accounts for roles that need invites.
Drift detection matters here too, since permission models change as you ship new features.
Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Need extra credits or help onboarding your app? Just reach out. Happy to help!
BetterClaw
Perfai Security
@shubham4real you've put your finger on the part we care about most 🙏. You're right, most scanners dump a vuln list and leave you to figure out the fix. That's exactly where Perfai Security is different.
To answer your question, no, we never write to your code behind your back. The Fix Agent figures out exactly what needs to change, whether that's a missing authorization check, or a policy that needs enforcing, then sends the suggested fix, together with the full vulnerability context, to the AI coding assistant you're already using (Cursor, Claude Code, Replit, Copilot, or Windsurf). You review it, apply it when you're happy, and nothing changes until you say so.
Perfai then re-runs the exact exploit to make sure the issue is actually closed. We don't consider a vulnerability fixed until we've verified it.
Developer in the loop by design.
Try it free at perfai.ai. Just paste your app URL and watch the finding → fix → re verify loop end to end. 🚀
this is a real gap. so many vibe-coded apps ship with auth or row-level security completely missing because the tool never surfaced it as a decision point. curious how deep the "fix" side goes though - does it actually patch broken access control rules in the code, or mostly flag the issue and leave the fix to you
Release AI
@omri_ben_shoham1
You nailed the root cause. The tools never surface auth as a decision point, so builders never make the decision. The gap ships silently.
On the fix side: it goes deeper than flagging. Every finding comes with a ready-to-run fix for your code agent. One prompt like "Fix All", "Fix Critical", or "Fix #2" and the patch gets applied where the flaw actually lives, whether that's your API authz logic or a data-layer rule. You don't need to figure out the fix yourself or be a security expert.
You stay in control though. You review what changes before it ships, so nothing load bearing gets touched blind. Find, fix, verify, done.
And with drift detection, we keep testing as your app changes, so new gaps get caught too.
Try it free at perfai.ai and get a full pentest-style report. We're giving away 50% discount codes for the launch too. Share your app URL and I'll get you a free report personally. Need extra credits or help onboarding? Just reach out. Happy to help!
This is a very timely problem. Vibe-coded apps can get to “working demo” incredibly fast, but access control and production security are exactly where small mistakes can become painful later.
I like the idea of making security checks feel as lightweight as pasting in a URL instead of requiring a full security workflow. When Perfai finds a live vulnerability, how much of the fix is automated versus guided for the developer to review and apply?
Release AI
@klein1
Great question! If you built with Replit, Lovable, or any AI coding tool, just run "Fix all Perfai issues" and it will instantly fix them. Each finding comes with the exact context your coding agent needs to apply the fix.
For everything else, our Fix Agent writes a suggested fix for each issue, with the permission gap explained and proof of how we exploited it. Your developer reviews and applies it. We keep a human in the loop on purpose, since access control changes can break real user flows if applied blindly.
Every finding ships in a pentest-style report, and we run drift detection too, so if a new gap shows up as your app changes, you'll catch it.
Try it free at perfai.ai. Use code PHLAUNCH50 for 50% off any paid plan, and if you want extra credits or onboarding help, just message me!
This is going to be huge as vibe coding takes off. Speed of building goes way up but security review doesn't keep pace. One prompt to find live vulnerabilities is a compelling pitch. What types of vulnerabilities are you catching most often?
Release AI
@masato_furuno1
Thank you! You nailed the gap. Building got 10x faster, security review didn't.
We test 80+ access control categories in total. The most common issues we catch:
Cross-tenant data leaks: OrgA reading OrgB's data through IDOR and BOLA gaps. This is the scariest one and shows up constantly in vibe-coded apps.
Broken role checks: A viewer or basic user doing admin actions, like deleting records or changing settings they shouldn't touch.
Same-tenant leaks: User1 seeing User2's private data inside the same org.
Unprotected APIs: The UI hides a button, but the API behind it accepts the request anyway. AI coding tools do this a lot.
So far we've tested 4,000+ apps, found 28,000+ vulnerabilities, and saved teams $27M in bug
bounty payouts. Every finding comes with proof in a pentest-style report, and drift detection keeps testing as you ship.
Try it free at perfai.ai. Code PHLAUNCH50 gets 50% off paid plans. Want extra credits or onboarding help? Just message me!
@intesar_mohammed1 28,000 vulnerabilities across 4,000 apps is a scary hit rate. The cross-tenant data leak one especially, that's the kind of bug that ends companies. Makes sense that it shows up more with AI-generated code since the model doesn't think about multi-tenancy by default. Nice work.
Congrats on the launch this is such a timely product given how fast vibe coding tools are scaling without security guardrails. Curious, when your platform finds and fixes vulnerabilities automatically how do you handle edge cases where a fix could break existing app logic? Is there a approval step before changes go live?
Release AI
@aymi_malik
Thank you! And great question. Yes, there's always an approval step. We never push changes to your app ourselves.
Here's the flow: Perfai finds the issue, shows you proof of how we exploited it, and writes a suggested fix with full context. Your developer (or your AI coding tool) reviews and applies it. If you built with Replit, Lovable, or Cursor, you can run "Fix all Perfai issues" and your coding agent applies the fixes, but you still review before deploying.
We keep a human in the loop on purpose. Access control changes can break real user flows if applied blindly, exactly the edge cases you're describing. After you apply a fix, just re-run the test. Perfai verifies the issue is gone and your other permission checks still pass. Drift detection also keeps testing as your app changes, so if a fix causes a new gap later, you'll catch it.