About the scanner

Why you are seeing us in your logs

Someone signed in to VibeSecurity and asked us to check your website for common security problems. We never crawl the web on our own. A scan only runs when an account holder adds a site and starts it by hand, and each scan makes a small, fixed number of requests.

How to recognise it

Every request carries this User-Agent:

VibeSecurityScanner/1.0 (+https://thevibesecurity.com/scanner)

What it requests

• Only GET requests on ports 80 and 443. It never sends a body, logs in, submits a form or changes anything.
• Your home page over HTTPS, and once over HTTP to see whether it redirects to HTTPS.
• Up to 15 JavaScript files that your home page loads from your own domain, to look for keys that should not be public.
• A short list of paths that should never be public, such as /.env, /.git/config, /.DS_Store, /backup.zip, /db.sql and any source map your scripts point to.
• Up to about 35 requests in total per scan, made a few at a time, with a scan allowed at most once a minute per site.
• Only after the site owner proves ownership: a few read-only requests to the Supabase or Firebase project your own scripts point to, asking only how many rows the public key can see (never the rows themselves), to show whether your database is open to the world.

The scanner does not brute-force, fuzz, follow links across your site or try to guess passwords. Secrets it finds are stored partly hidden (the first and last few characters), never in full.

How to block it

• Block the User-Agent above in your firewall, CDN or web server.
• Or email support@thevibesecurity.com with your domain and we will add it to our block list, so it cannot be scanned from any account.

If you think it was misused

If a scan was started against a site the person does not own or have permission to test, tell us at support@thevibesecurity.com. Include the domain and the time from your logs. We can look up which account started it and act on it. Read our responsible use policy for the rules everyone agrees to.