Launching today

VICE Platform - Private Beta

Launching today

Security scans for people who ship fast

4 followers

Security scans for people who ship fast

4 followers

Visit website

VICE audits your web app the way an attacker would: leaked secrets in your bundles, Supabase RLS misconfigurations, exposed APIs, weak headers and infrastructure.... The engine is open source and free today, as a CLI or a GitHub Action. The hosted Platform adds the full loop: verify your domain, run a full audit, get findings with evidence, apply a suggested fix, then retest to confirm it's gone. It opens as a private beta with 10 founding spots. Built for indie builders who ship fast.

VICE Platform - Private Beta gallery image

Free

Launch tags:Open Source•Developer Tools•GitHub

Launch Team / Built With

Framer AI AgentsDesign and publish professional sites with AI

Promoted

Forge

Maker

📌

Hey Product Hunt 👋 Modern stacks make it trivial to ship something that works, and just as easy to ship a secret into your client bundle, or a Supabase table anyone can read anonymously. The app runs fine. Nothing looks broken. That's the trap: "it works" and "it's actually protected" are two different questions, and most of us only ever test the first one. The tools that answer the second question exist. They start around $200/month and are built for compliance teams. Or they're CLIs built for pentesters. If you're a solo builder or a small team, there's nothing in between. What's free today: - The VICE engine is open source: automated DAST + SAST checks, Supabase/RLS analysis, API, GraphQL and WebSocket coverage, security headers and infrastructure checks. - Run it as a CLI or drop the GitHub Action into your CI. What's opening today: the hosted Platform, in private beta. Same engine, hosted, plus the loop that actually makes you safer: verify your domain, run a full audit, get findings with evidence (not just "trust me"), apply a suggested fix written so you can paste it straight into Cursor, Codex or Claude Code, then retest to confirm it's gone. I'm taking 10 founding participants. Not a waitlist: accepted participants get real dashboard access, run real audits on their own apps, and I personally review every high and critical finding during the program. Planned pricing is public on the site. The beta exists to validate the product, not to stay free forever. A few honest limits, because this is a security tool and trust is the whole product: - It only scans domains you own and verify. - A clean result means "nothing found in the covered scope", never "you're safe". The report always shows you what was covered. I'll be in the comments all day. Happy to go deep on how the engine works, what it found on my own apps, and why RLS is where indie SaaS actually bleed.

Report

2d ago

@luca_deguin Congrats on the launch Luca. Does open sourcing teh engine not in itself pose a security risk?

Report

8h ago

Forge

Maker

@zolani_matebese Thanks for the message, good question.

The open source engine only observes what an anonymous browser can already reach. No exploits, no brute force. Closing the source would take nothing away from an attacker, it would just remove your ability to check what we run against your production.

The hosted version goes further and runs more intrusive probes, but only once you have verified ownership of the domain. That authorisation step is what unlocks the deeper tests, not the secrecy of the code.

nmap, semgrep, ZAP and gitleaks are open source for the same reason. What stays private on our side is the infrastructure and customer results, not the detection logic.

Report

8h ago