Frequently asked questions
Everything you need to know before scanning your first app.
Is my vibe-coded app secure?
+
Most apps built with AI coding tools (Cursor, Bolt, Lovable, v0) have at least one security issue — not because AI is bad, but because speed-optimized code skips security defaults. Common issues include API keys left in JavaScript bundles, missing security headers, exposed admin routes, and outdated dependencies with known CVEs. StackSecured scans for all of these in ~30 seconds.
What does StackSecured actually scan?
+
We run 10 security engines against your live, publicly-accessible app: API key exposure in JavaScript bundles, known CVE vulnerabilities in your tech stack, CORS misconfiguration, missing security headers (HSTS, CSP, X-Frame-Options), exposed admin or debug routes, config file leaks (.env, .git/config), GraphQL introspection exposure, cookie security flags (HttpOnly, Secure, SameSite), historical file exposure via the Wayback Machine, and active injection probes (XSS, SQL injection, open redirect, rate limiting).
How is StackSecured different from other security tools?
+
Most security tools are built for security engineers. They output raw CVE IDs, terminal commands, and jargon that requires months of training to interpret. StackSecured is built for founders and product people. Every finding includes: what is wrong (plain English), why it matters to your business (not to a security engineer), and a copy-paste fix your developer can apply immediately. We also scan specifically for the patterns that appear in AI-generated code — not generic enterprise vulnerabilities.
Do I need technical knowledge to understand the results?
+
No. That is the entire point. Every finding is written so a non-technical founder can understand the business risk ("An attacker can steal every user session on your site") and hand the fix to their developer ("Add this header to your Next.js middleware file"). You do not need to know what CORS, XSS, or HSTS mean to act on the results.
What does the security score mean?
+
The score (0–100) reflects how many vulnerabilities were found and how severe they are. Critical findings deduct 25 points, High deduct 15, Medium deduct 8, and Low deduct 3. A score of 80+ is considered low risk. 65–79 is medium risk. Below 65 is high or critical risk — meaning real attackers could compromise your app or your users' data. Most vibe-coded apps score between 45 and 75 on their first scan.
Is the free scan really free?
+
Yes, completely free. No credit card, no signup required. The free scan gives you a real security score, all severity breakdowns, every passed security check, and two full findings with impact statements and copy-paste fixes. If you want all remaining findings unlocked, that is a one-time ₹1,999 charge for that specific scan.
Will scanning my app slow it down or affect my users?
+
Minimally. We make standard HTTP requests to your public endpoints — the same requests any visitor makes. Our active probes (XSS, SQLi) are designed to test without causing damage. The scan typically takes 15–45 seconds. During that time, your app will see a small spike in traffic — roughly equivalent to 10–15 simultaneous visitors.
Can StackSecured see my database or source code?
+
No. We only scan publicly accessible endpoints — the same things a browser or API client can see. We cannot access your database, private files, Supabase tables, or source code. We test what attackers can see, which is exactly what matters.
How often should I scan my app?
+
Scan immediately if you have never done it. Then scan after every major deployment (new features, new dependencies, new API endpoints). If you are on the Annual Plan, we automatically scan your app every 30 days and email you if the score drops.
What if I cannot fix the issues myself?
+
Each finding includes a copy-paste fix — usually a code snippet or a config change. You can send the full report directly to your developer. If you built the app with Cursor or Bolt, you can paste the fix directly into your AI coding tool and ask it to apply it. Most findings take under 30 minutes to fix.
Is StackSecured legal? Am I allowed to scan my own app?
+
Yes, absolutely. Scanning an app you own is legal and encouraged — it is standard security practice. StackSecured may only be used on apps you own or have explicit written permission to test. Scanning a third-party app without permission is unauthorized computer access and is illegal in most jurisdictions.
What happens to my scan data?
+
Scan results are stored in our database for 90 days, then permanently deleted. We do not share your scan results with third parties. Free scans are stored without association to any account. If you create an account, your scan history is linked to your email address. See our Privacy Policy for full details.