The Vibe App Scanner lifetime deal starts at $49 for 15 website scans per month across 3 websites. Repository analysis has separate higher-tier allowances and beta limitations; it is not unlimited scanning of every codebase.
Vibe App Scanner fits a builder who wants a structured scan-and-fix loop and can review the proposed changes. Tier 2 is the starting point for MCP and current repository scanning; Tier 3 adds REST API access and higher pools. Skip it as a sole assurance tool when you require proven coverage of every backend framework or production firewall arrangement.
Suitable for
Builders checking deployed AI-assisted apps; Teams reviewing findings with a coding assistant; Small portfolios needing recurring checks
Consider another option if
Repository analysis remains beta with separate rules; REST API and MCP have different tier gates; Framework and firewall coverage can be incomplete
What comes with the lifetime deal?
Website pool
15 /50 /150 monthly
Repository pool
Separate higher-tier beta
MCP
Tier 2 and above
REST API
Tier 3
PLANS AND PRICING
Vibe App Scanner plans and pricing
Prices and allowances are shown for each plan below.
PLAN DETAILS
Compare each plan’s price and allowance. Confirm any limit marked ‘Not specified’ before buying.
Vibe App Scanner plans and limits · USD
Plan comparison3 plans
License Tier 1
License Tier 2
License Tier 3
PriceUSD
$49one-time
$119one-time
$249one-time
Billing
One-time payment
One-time payment
One-time payment
Monthly website scans
15scans/month
50scans/month
150scans/month
Website slots
3websites
10websites
Unlimitedwebsites
Monthly repository scans
0scans/month
20scans/month
50scans/month
Saved repository/folder targets
0targets
3targets
10targets
Who this tier fits
Up to three websites, no repository scans or MCP/API.
MCP workflow plus current repository beta access.
REST API access and larger website/repository pools.
Keep in mind
Repository allowances are currently separate; post-beta terms and AI-review usage need confirmation.
Repository allowances are currently separate; post-beta terms and AI-review usage need confirmation.
Repository allowances are currently separate; post-beta terms and AI-review usage need confirmation.
Plan notes
Up to three websites, no repository scans or MCP/API.
Repository allowances are currently separate; post-beta terms and AI-review usage need confirmation.
MCP workflow plus current repository beta access.
Repository allowances are currently separate; post-beta terms and AI-review usage need confirmation.
REST API access and larger website/repository pools.
Repository allowances are currently separate; post-beta terms and AI-review usage need confirmation.
Select the final tier on AppSumo. The product link opens the same listing for every tier.
Repository analysis remains beta with separate rules
REST API and MCP have different tier gates
Framework and firewall coverage can be incomplete
Budget both routine scans and verification scans
Tier 1 costs $49 for fifteen website scans and three website slots. If each of three sites is checked four times in a month, twelve scans are used before any fix verification. That leaves only three further runs. A monthly scan pool should therefore include rescans, not just monitoring.
Tier 2 costs $119 for fifty scans and ten sites. Its MCP connection is useful when an assistant should request a website scan and retrieve the report. The rendered comparison still excludes REST API access from this tier.
Tier 3 costs $249 for one hundred fifty website scans and unlimited site slots, plus REST API access. Unlimited registered websites do not multiply the scan pool. A large client portfolio can exhaust it even if each site is scanned only occasionally.
Repository scans have a separate, narrower contract
The October 26 founder reply states current repository allowances of twenty scans and three saved repository/folder targets on Tier 2, and fifty scans and ten targets on Tier 3. Tier 1 has none. These counters are separate from the website scan pool; repository AI review has its own usage limits.
The same reply declines to promise unannounced post-beta allowances and says the terms will be made explicit before beta ends. Buy based on the current documented scope, not an assumption that every future code-analysis capability will be unlimited.
Repository runs are not yet available through the public MCP/REST start, status, listing or export workflow. A repository report created in the dashboard cannot simply be retrieved through the website-scan list endpoint. Supported end-to-end GitHub push/PR scanning and repository SARIF output were also not yet offered in that answer.
Check whether your framework is actually assessed
The founder specifically says first-class Laravel route, middleware, policy and PHP data-flow analysis is not currently available. Generic checks may still find secrets or vulnerable dependencies, but that does not establish correct authorization throughout a Laravel application.
A buyer evaluating a real Laravel/Inertia project prompted detailed discussion about coverage labels, development dependencies and grouping package upgrades. This is more useful than treating a large count of checks as evidence that every language and framework is equally understood.
Inspect the coverage summary before relying on a report. A missed route or unsupported framework should remain unassessed, not be translated into a pass. The same principle applies to a scanner failing to reach pages protected by an interactive challenge.
Use the remediation export as a reviewed change request
The report’s AI Fixes & Export option produces Markdown with findings, evidence and remediation guidance. Give that to a developer or coding assistant together with the actual project context. Ask it to check applicability and propose a small change with a meaningful verification step.
Review the code and run the affected user journey before deployment, then rescan the same issue. A security-header suggestion, database permission change and dependency upgrade have different side effects. Applying every generated recommendation at once makes a regression harder to locate.
The newest visible review describes affected-URL evidence for headers, email policy and other deployment issues. Another buyer found the distinction between monitoring and scans unclear, and the founder acknowledged the presentation problem. These reports support evaluating usability; they are not proof of a particular detection rate.
Private repository access still creates a data-handling decision
The October founder answer says source and working files are temporary and cleaned up after processing, while reports and redacted finding evidence are retained separately. It gives repository reports a thirty-day retention window and describes the GitHub App permissions as Contents:read and Metadata:read.
When AI review runs, bounded redacted code context is sent to the configured AI provider. A temporary clone is therefore not the same as code never leaving your own systems. Confirm that arrangement against the client’s data requirements before connecting a private repository.
Install access only on the repositories needed for evaluation. Persistent false-positive decisions are described for supported findings when the evidence and repository/branch/folder scope remain unchanged. Older findings may only support per-scan feedback, so do not assume every dismissal will survive a new run.
A reachable test environment matters
The founder does not guarantee bypassing interactive Cloudflare challenges and does not yet publish a stable scanner-IP/user-agent allowlisting contract. The suggested alternative is a suitably configured staging environment. That can cover application behavior while leaving production-specific settings for separate review.
Decloak offers a different daily-per-domain model and an Enterprise active-testing tier. Compare the desired evidence and coverage first, then the quota. A free preliminary scan or existing static checks may be enough for an early prototype, but neither replaces checking business logic and roles.
The AppSumo offer has a sixty-day activation/refund window, upgrade availability while live and a sixty-day downgrade period. Its terms reserve possible future model add-ons. The vendor’s direct refund page describes different direct-sale rules, which should not be substituted for the marketplace purchase terms.
FEATURE COMPARISON
Features, limits and paid extras
“Included” and “unlimited” can mean different things. This checklist separates full access, usage limits, add-ons and features that are not confirmed.
Feature coverage2 / 8
2 fully included · 6 limited · 0 add-on · 0 not included · 0 not confirmed. Coverage is not a quality score.
Active testingProbe behavior beyond passive observations within authorized scope.
Limited
Live checks investigate exposed behavior; do not equate them to a full human pentest.
Authenticated coverageInvestigate routes requiring a permitted test account.
Limited
Authenticated checks are discussed; coverage depends on reachable workflows.
Recurring checksSchedule checks within the applicable quota.
Limited
Weekly automation is listed, with tier gates and monthly pools to check.
REST APIAutomate supported scan operations.
Limited
REST API is Tier 3; repository runs are not yet exposed through it.
AI assistant connectionUse supported MCP tools without assuming full API equivalence.
Limited
MCP starts at Tier 2 and currently covers website scans.
Check each product’s plan notes for tier limits and additional costs. Feature coverage is not a quality rating.
USE CASES
What problems does Vibe App Scanner solve?
01
Close the loop after an AI-assisted change
A builder needs evidence that a reported exposure was fixed.
How to use it
Scan the reachable app and identify the exact affected URL.
Export the finding with context and review the proposed code change.
Run the user journey and rescan the same issue.
What this helps you do: The fix can be connected to observed evidence.
Limitations: Scanner coverage and false positives still require judgment.
02
Evaluate a private repository
A team needs checks beyond the public website.
How to use it
Confirm tier, framework coverage and code-handling rules.
Grant read access only to the chosen repository.
Review the dashboard report and export it within retention.
What this helps you do: Source-visible findings can complement URL checks.
Limitations: Repository CI/API integration and post-beta scope are not promised.
BUYER FEEDBACK
What buyers say
Buyer experiences can vary with the plan, product version and workflow.
Mixed feedback
Actionable output with coverage caveats
Five newest visible reviews include praise for evidence and support, alongside concerns about monitoring presentation and incomplete framework-specific findings. Founder replies clarify several current repository and firewall limitations.
