Security for vibe coders · Issue #001

Find your app's security holes. Get the exact fixes.

Paste a URL. PatchPilot probes your app across 29 vulnerability classes, ranks what matters, and hands you a copy-paste fix prompt for each finding.

Free · ~30 seconds · No signup

Light scan report patchpilot.dev/scan/8f3a

Missing security headers

evidence: no content-security-policy on /

Medium

Exposed version banner

evidence: server: express/4.18.2 on :443

Medium

Cookie missing Secure flag

evidence: set-cookie: session=… (no secure)

Low

3 findings · 0 critical · scanned in 28s VIEW FULL SAMPLE →

How it works

Three steps. Zero security degree required.

Paste your URL

Drop in any public URL — staging link, demo deploy, side project. No install, no agent, no code access.

Pick Light or Full

Light scan is free and deterministic — instant hygiene check. Full pentest goes deep across all 29 classes.

Copy the fix prompt

Every finding ships ranked, with evidence and a paste-ready prompt your AI coder can execute verbatim.

Coverage

29 vulnerability classes. One report.

full pentest covers all 29 · light covers 9

sql-injection xss-reflected xss-stored csrf broken-auth idor ssrf open-redirect security-headers cookie-flags cors-misconfig jwt-weakness rate-limit-absent dir-traversal xxe ssti nosql-injection command-injection file-upload-abuse info-disclosure version-banner clickjacking subdomain-takeover oauth-flaws api-enum mass-assignment race-condition proto-pollution dependency-cve

Sample finding

This is what a Full finding looks like.

Critical

SQL Injection in /api/users

CONF 0.94 · CWE-89

Evidence

GET /api/users?sort=id;SELECT pg_sleep(5)--
→ response delayed 5,012ms (baseline 84ms)

GET /api/users?sort=' OR '1'='1
→ returned 4,318 rows (expected ≤ 50)

Impact

Attacker-controlled sort reaches a raw query. Full table read demonstrated; write access likely. Fix before any public launch.

Fix prompt — paste into your AI coder

In /api/users, the `sort` query param is interpolated into raw SQL. Reproduce with the evidence above, then: 1) allowlist sort columns (id, name, created_at) and direction (asc/desc); 2) switch to parameterized queries / ORM bindings — never string-concat user input; 3) return 400 on invalid sort values; 4) add a regression test asserting `sort=id;SELECT pg_sleep(5)--` is rejected with 400 and constant-time response.

Pricing

Pay per scan. Nothing else.

No seats. No subscriptions. No signup for Light.

Light

free · deterministic · ~30 seconds

✓ 9 hygiene classes (headers, cookies, banners)
✓ Ranked findings with evidence
✓ No signup, read-only scan

Run Light scan — free

Recommended

Full

$29

one-time per scan · AI pentest · ~10 minutes

✓ All 29 vulnerability classes
✓ Ranked findings + copy-paste fix prompts
✓ Shareable report link for cofounders

Run Full pentest — $29

FAQ

Fair questions.

Is the scan safe? Will it break my app?

Yes. Scans are strictly read-only — we send probing requests and read responses, but never write, delete, or modify anything. Light scans stay well under normal traffic levels.

What's the difference between Light and Full?

Light is a free deterministic check across 9 surface hygiene classes — headers, cookies, banners, CORS basics. Full is an AI-driven pentest across all 29 classes, including injection, auth flaws, and business-logic abuse, with fix prompts for every finding.

Do I need to give you code access?

No. PatchPilot is black-box: point it at any public URL. That also means it tests what attackers actually see — your deployed app, not your repo.

What do I get for $29?

One Full pentest of one target: all 29 classes, ranked findings with evidence, a copy-paste fix prompt per finding, and a shareable report link. One-time charge per scan — no subscription.