Frequently asked questions

Is the scan safe for my site?

Yes. The free Vibe Check is passive and non-invasive — we fetch public pages and inspect responses, headers, TLS and exposure. We never attack your site, brute-force, or attempt exploitation.

Why do you verify ownership before scanning?

To protect site owners from unauthorized scanning. For now, you must request a scan using a work email on the site’s own domain (e.g. [email protected] to scan yourapp.com) — this confirms you’re an admin or staff member. You then verify that email via a one-time link before the scan begins. If you can’t use a matching email, book a short call and we’ll verify you another way (e.g. a DNS record). We never scan a site we can’t tie to an authorized requester.

Can I scan any website?

No — only sites you own or are explicitly authorized to test. We log every request and may notify the real owner and relevant authorities about unauthorized attempts.

What’s the difference between the free scan and a deep scan?

The free Vibe Check is a fast passive snapshot. A Deep Scan (Web App Pentest, API Security, or Network & Server) is a thorough assessment with full findings, remediation and a branded report — the kind of thing agencies charge $5,000–$30,000 for.

Do you store my data?

We store your email, the target URL and your report so you can access it in your portal. Reports are isolated per client. See our Privacy Policy. You can ask us to delete your data anytime.

Is this a replacement for a penetration test or certification?

No — it’s the smart first step. Fix the obvious issues cheaply and continuously with Vibe AI, so when you pay for a formal pentest or a SOC 2 / ISO 27001 / Cyber Essentials assessment, it passes faster and cheaper.

How do I buy a deep scan?

During launch, deep scans are arranged on a quick call — book here to claim the launch offer. For intrusive/deep scans we’ll also ask you to allowlist our scanner IP.