I may have made something dangerous for vibe coded apps

We built a free scanner because a lot of people are launching real apps without knowing what security questions to ask.

It checks exposed keys, open databases, source maps, config files, CORS etc.

The problem is a clean scan feels very reassuring.

Too reassuring.

It doesn’t mean your login works properly. It doesn’t mean users can’t access each other’s data. It doesn’t mean your backend trusts the right things.

So I made a self serve Deep Review. The owner proves control, signs the scope, then it can run bounded DAST, repo analysis and optional two-user testing.

No human approval from us.

Now I’m wondering if the cure is worse than the problem.

If somebody wanted to misuse this, how would they do it? Temporary domain access? Stolen GitHub account? Recon? Attacking the runner? Just generating load?

https://www.task-bounty.com/secure-my-app#deep-review

Tell me why this should not be public.