Your app is leaking user data.
You just haven't looked.
Vandel is a security scanner for web apps. Every other scanner runs a checklist. Vandel points a real attacker at your live app, finds the leaked keys, the open tables, the routes you forgot to lock, then hands you the fix.
Pointed at OWASP Juice Shop, a real vulnerable app nobody built for us, it found 5 holes on its own: a SQL-injection admin login, the whole user table dumped through the search box, and three more.
$ curl -s https://acme.app/.env
DATABASE_URL=postgres://u:p@db/prod
STRIPE_SECRET_KEY=sk_live_51Nx…9Kp ← served to anyoneFix. Stop serving .envfrom the web root, and rotate that key now. It's already public.
Everyone else runs a checklist. Vandel sends a hacker.
The other scanners pattern-match your live URL for known issues. Great for the obvious stuff, blind to everything else. The real bugs, the ones an attacker actually uses, are two or three steps deep and behind the login. That takes an agent that reasons, not a list.
- Greps your bundle for known key patterns
- Checks headers and config
- Probes if RLS is on or off
- Can't log in. Can't chain. Can't reason.
- Everything a checklist does, plus:
- Logs in with its own test accounts
- Changes an id, reads another user's data (IDOR)
- Chains a signup bug into an admin takeover
It goes after what vibecoding gets wrong by default.
AI writes the happy path and skips the locks. These are the holes it leaves, with the exact request that pulls each one.
- idorAny user's data, no login
GET /api/users/2 - rls-offYour whole table via the anon key
GET /rest/v1/profiles - secretsService keys in the client bundle
grep sk_ /_next/*.js - adminAdmin export behind a leaked token
GET /api/admin/export - privescSign up, set role:admin, get in
POST /api/signup - ssrfFetch feature to cloud metadata
?url=169.254.169.254
How it runs
- 01Point it at your app, prove you own it. Paste one prompt into the agent that built it (Cursor, v0, Lovable). It drops a verification file and deploys. Takes a minute, no dashboards, no repo access.
- 02The agent hunts your live app. From the outside, like a real attacker. It uses its own throwaway test accounts and never touches your users' data. The deep pass runs monthly. The cheap surface and config checks run on every deploy.
- 03You get the holes and the fixes. Every hole, the exact request that proves it's real, and the one-line fix. In plain English.
of vibe-coded apps scanned had at least one security flaw
AI-built apps live right now and leaking data
API keys leaked from one app, straight out of its JavaScript
This already happened. To real apps. Last year.
Not hypotheticals. Public breaches, each one caused by exactly the kind of hole Vandel checks for.
Auth checks ran client-side, bypassable with DevTools. Paywall skipped, API drained, DB filled with junk.
A storage bucket left open to the internet. No password. Directory listing on.
RLS shipped off by default, so the public anon key could read every table.
Simple pricing.
Start free on any URL. One plan covers all your apps, watched, or actually attacked.
One scan. See how many holes you have and how bad.
- →Surface + config scan
- →Count and severity of every issue
- →No card required
Your one or two main apps, watched. Every deploy re-checked, and you're pinged the moment a hole appears.
- →Up to 2 apps
- →Full findings with the exact fix
- →Continuous checks on every deploy
- →Alerts when a new hole ships
Up to five apps, each pentested every month by a swarm of attacker agents.
- →Up to 5 apps
- →Everything in Monitor
- →Monthly pentest by a swarm of specialized AI agents
- →Each hunts a different class: access control, injection, secrets
- →Finds IDOR, privilege escalation, and chained logic bugs a checklist can't
- →The full report, with reproductions
Cancel anytime. The average startup data breach costs six figures, this is $10 to $30 a month.
Questions
+Is it safe to run on my live app?
Yes. The scan is read-only by default, and the agent uses its own throwaway test accounts, it never reads, edits, or deletes your real users' data. It paces itself so it won't trip your host's rate limits.
+Do you need my code or repo access?
No. Vandel tests your deployed app from the outside, the way an attacker would. You prove you own the domain (one file or a Vercel connect), and that's it. We never see your source.
+How is this different from the other scanners?
Everyone else runs a checklist against your URL, they pattern-match for known issues. Vandel does that too on the free and Monitor tiers, but the Agent tier sends a reasoning AI that logs in, chains steps, and finds the access-control and logic bugs a checklist structurally can't see.
+What does it actually find?
Exposed keys and .env files, databases with RLS off, admin and debug routes with no auth, IDOR (reading other users' data by changing an id), privilege escalation, SSRF, and the chained versions of all of these.
+Can I cancel anytime?
Yes, one click, no lock-in. You keep access through the end of the period you paid for.
Talk to us
Sales question, a bug, a big app you want scanned, or just curious. Real replies, usually within a day.
Check your app before someone else does.
One scan, free, no card. See what's exposed in about a minute.
Scan my app free