FlawPilot

FlawPilot is a free scanner for AI-built and vibe-coded apps. Paste a URL and get scored results across security, performance, infrastructure and technical SEO. Connect a repo and it also scans your source code. Every finding comes with a ready-to-apply fix, explained in plain English. AI app builders like Lovable, v0, Bolt.new, Replit and Cursor ship fast, but the defaults are not always safe. FlawPilot catches the usual problems: missing DMARC records, weak security headers, exposed services and misconfigured Supabase storage. What it checks: - Security: headers, TLS, CSP, CORS, SPF, DKIM and DMARC - Performance: Core Web Vitals (LCP, INP, CLS), page weight, render-blocking assets and caching - Infrastructure and DNS: CDN and WAF detection, DNS health, exposed services and ports, subdomain and edge hygiene - Technical SEO: titles, meta tags, headings, canonicals, robots, sitemap, schema, crawlability and AI-readability - Source code: connect GitHub, GitLab or Bitbucket to scan for insecure code, exposed secrets, vulnerable dependencies and code quality, each scored separately You get 117 checks without signing in. A free account runs 137+ checks and keeps every scan. Built for developers and AI assistants: - MCP server for Claude Desktop and Claude Code, Cursor, VS Code Copilot and Antigravity, with setup guides for ChatGPT and Gemini. Try: "Scan example.com with FlawPilot and summarize the critical findings." - REST API for automation - CI/CD gating with GitHub Actions, GitLab CI and Bitbucket - Site Health mode that crawls every page and runs Lighthouse on each - Embeddable score badge for your site - Manual pentest available on request FlawPilot is lighter than SonarQube: there is no server to run, and it also checks your deployed site, not just the code. Comparison pages for SonarQube, Snyk, Wiz and CodeAnt AI are on flawpilot.com. Free to use.