[VibeWrench] Add runtime analysis for security scanning

Hey r/webdev, So I shipped a side project a few months ago. Built it with Claude Code, felt pretty good about it, decided to run a security check before I forgot. My API keys were in the source. Just... right there. CSRF protection? Nope. Cool. Anyway that was humbling. And then I thought — wait, if I'm doing this, and I actually care about security at least a little bit, what does everyone else's vibe-coded stuff look like? I built a scanner to find out. **What I actually did** Pulled 100 public GitHub repos. Lovable, Bolt.new, Cursor, v0.dev projects. Ran automated security scans across all of them. The numbers were bad: - 318 vulnerabilities. 89 CRITICAL. - 65% scored below 70/100 on security - 41% had API keys or secrets in the source code. Forty-one percent! - Multiple Supabase service_role keys committed to public repos, which is... yeah Then I checked 50 AI app system prompts for prompt injection. 90% scored CRITICAL. Average was 3.7 out of 100. That one honestly surprised me. **What VibeWrench does** 18 scan types — security, Lighthouse speed, SEO, accessibility, dependency audit, prompt injection (OWASP LLM01). You paste a URL or GitHub repo, results come back in ~30 seconds. The thing that bugged me about existing scanners is they spit out stuff like "Missing CSP header on response object" and I'm sitting there at 2am going "ok but what do I DO with that." So VibeWrench translates findings into plain English — "Your website doesn't tell browsers to block suspicious scripts" — and gives you a Fix Prompt you can paste straight into your AI tool. Because realistically, most of us using these tools are not security people. I'm definitely not. **Stack:** Python, FastAPI, Playwright for the browser-based scans, DeepSeek V3 handles the AI analysis side, PostgreSQL. All running on one Hetzner box that I keep telling myself I'll upgrade eventually. **What it can't do yet:** - Static analysis only, no runtime/DAST — that's coming but it's a lot of work - The AI analysis flags false positives sometimes (there are confidence scores to help filter those) - It's just me building this so some edges are rough. I know. Free tier gives you 3 scans/month, no signup required. https://vibewrench.dev/?utm_source=reddit&utm_medium=post&utm_campaign=launch&utm_content=webdev Wrote up the full methodology and data from the 100-app scan here: https://dev.to/vibewrench/i-scanned-100-vibe-coded-apps-for-security-i-found-318-vulnerabilities-4dp7 If you want to nerd out about the scanning pipeline or pick apart the data — I'm here.