---
title: Vibe Check Scan
description: Passive web security scanner for modern web apps.
---

# Vibe Check Scan

Vibe Check Scan is a passive web security scanner for public websites. It performs only
safe, read-only HTTP requests (GET, HEAD, OPTIONS). No authentication is required.

## What it checks

- **Security Headers** (26.25%) — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Each finding reports presence separately from assessment, so "absent" is distinguished from "misconfigured".
- **TLS/SSL** (22.5%) — Protocol version, certificate expiry, trust chain, cipher strength.
- **CORS Policy** (15%) — Wildcard origins, credentials policy, localhost/null origin exposure.
- **API Surface** (11.25%) — Classifies probed paths into confirmedExposure, needsReview, protectedSurface, expectedPublicEndpoint and hardeningOpportunity. Server-secret material and exposed .env files are confirmedExposure. Public client config is informational. Only confirmedExposure findings affect the score.
- **React / Next CVEs** (25%, confirmed matches only) — Passively detects React Server Components and the React version, then checks that version against the OSV.dev advisory database for react-server-dom-* packages. No vulnerable-version list is maintained server-side. Only a confirmed advisory match (status confirmed_vulnerable) affects the grade; not_vulnerable and uncertain are informational and excluded from the weighted average.

## Core API workflow

1. Start a scan with `POST /api/scan/start` and body `{"url":"https://example.com"}`
2. Poll `GET /api/scan/status?id={scanId}&format=agent` every 2-3 seconds
3. Stop when the top-level `status` becomes `completed` or `error` — the terminal
   response carries the result inline, so a separate result fetch is usually unnecessary

## Grading

- A: 90-100
- B: 80-89
- C: 70-79
- D: 60-69
- F: <60

## Agent discovery

- API docs: https://vibecheckscan.com/developers
- OpenAPI: https://vibecheckscan.com/api/openapi.json
- Capability registry: https://vibecheckscan.com/api/agent/capabilities
- Agent card: https://vibecheckscan.com/api/agent/card
- Result interpretation guide: https://vibecheckscan.com/api/agent/interpret
- API catalog: https://vibecheckscan.com/.well-known/api-catalog
- Agent skills index: https://vibecheckscan.com/.well-known/agent-skills/index.json
- Overview: https://vibecheckscan.com/llms.txt

## Notes

- No authentication is required for the public scan APIs.
- OAuth/OIDC discovery metadata is intentionally not published because there is no real
  issuer or protected-resource flow yet.
- There is no MCP server. Use the REST API described by the OpenAPI document above.
- Passive only. Uses GET/HEAD/OPTIONS requests. No fuzzing, brute-force, or POST requests during scanning.