Question 1

What is Vuln0x?

Accepted Answer

Vuln0x is an AI-powered security scanning platform designed specifically for web applications built with AI-assisted coding tools like Replit, Bolt, Lovable, Cursor, and v0. It runs 27 parallel scanner engines to detect vulnerabilities in headers, SSL/TLS, CORS, cookies, directories, DNS, ports, and more — including 10 Next.js/React-specific scanners.

Question 2

What types of vulnerabilities can it detect?

Accepted Answer

Our scanners detect missing security headers (HSTS, CSP, X-Frame-Options), SSL/TLS certificate issues, CORS misconfigurations, insecure cookies, exposed files and directories (.env, .git, backups), DNS misconfigurations (SPF, DMARC, DNSSEC), open ports, technology fingerprinting, source map exposure, client-side secret leakage, authentication logic flaws, XSS, SSRF, and more.

Question 3

Does it support Next.js and React-specific issues?

Accepted Answer

Yes. We have 10 dedicated scanners specifically designed for Next.js and React applications. These detect source map exposure, client-side secrets leaked in JavaScript bundles, authentication logic flaws, cross-site scripting (XSS), server-side request forgery (SSRF), and other framework-specific vulnerabilities that generic scanners miss.

Question 4

How does credit-based pricing work?

Accepted Answer

Every new account receives 20 free credits. A full scan (all 27 engines) costs 10 credits. Individual scanner types cost 1-5 credits each. Rescans of the same URL cost 50% less, and verifying a single finding costs just 1 credit. You can purchase additional credits or upgrade to a plan with monthly credit allocations.

Question 5

Can I integrate it into my CI/CD pipeline?

Accepted Answer

Absolutely. Our REST API supports both Bearer token and API key (ss_ prefix) authentication. You can trigger scans from GitHub Actions, GitLab CI, Jenkins, or any CI/CD system. JSON reports are CI/CD-optimized, and SARIF reports integrate directly with GitHub Security tab.

Question 6

What report formats are available?

Accepted Answer

We support four export formats: SARIF (for GitHub Security tab integration), CSV (for spreadsheet analysis), PDF (professional reports with summary tables and recommendations), and JSON (structured data for CI/CD pipelines and custom integrations).

Question 7

Is my data safe during scanning?

Accepted Answer

We only perform non-invasive scanning — we never attempt to exploit vulnerabilities, modify your application, or store sensitive data. All scan results are encrypted at rest and in transit. You can delete your scan history at any time. We are committed to responsible security testing practices.

Question 8

What are scheduled scans?

Accepted Answer

Scheduled scans let you automate security monitoring. Set up daily, weekly, biweekly, or monthly scans for any URL. You will receive HMAC-signed webhook notifications when new vulnerabilities are found or your security score changes, so you can stay on top of your security posture without manual effort.

Question 9

Can I scan multiple URLs at once?

Accepted Answer

Yes. You can use our Projects feature to group multiple URLs together and scan them all with a single command. You can also use the bulk scan API endpoint to submit multiple URLs simultaneously. Each URL is scanned independently and results are tracked per target.

Question 10

Do you offer a free tier?

Accepted Answer

Yes. Every new account receives 20 free credits — enough for 2 full scans or 20 individual scanner runs. No credit card is required to sign up. This lets you evaluate the platform and see exactly what vulnerabilities exist in your applications before committing to a paid plan.

Find security vulnerabilities in your vibe-coded projects before attackers do

Everything you need to secure AI-generated code

27 Parallel Scanners

Risk Scoring A+ to F

Next.js & React Deep Scan

Scheduled Scans & Webhooks

Reports: SARIF, CSV, PDF

API & CI/CD Integration

Scan in 3 simple steps

Enter Your URL

Run the Scan

Fix & Track

Loved by developers building with AI

Frequently asked questions

Start securing your vibe-coded projects today