Perfai Security

This is going to be huge as vibe coding takes off. Speed of building goes way up but security review doesn't keep pace. One prompt to find live vulnerabilities is a compelling pitch. What types of vulnerabilities are you catching most often?

Great idea! Quick question: how do we ensure this fix doesn't break anything or cause a regression in the application?

Great concept. My team runs into this problem consistently. Even with AI guardrails and instructions, we have to spend valuable hours testing for vulnerabilities.

This is a very timely problem. Vibe-coded apps can get to “working demo” incredibly fast, but access control and production security are exactly where small mistakes can become painful later.I like the idea of making security checks feel as lightweight as pasting in a URL instead of requiring a full security workflow. When Perfai finds a live vulnerability, how much of the fix is automated versus guided for the developer to review and apply?

The decision to require just a single prompt to turn a freshly vibe-coded app into something production-ready is genuinely clever, cuts straight past the usual security onboarding friction.

Congratulations to the whole @Perfai Security team!! In the AI era, auth and access control issues have become an epidemic, and they're often some of the hardest vulnerabilities to catch before they reach production.We're actually using Perfai ourselves to help ensure the Dashboard for @Wristband's multi-tenant auth platform is configured correctly and that tenant isolation and authorization rules behave as expected. It's been a great addition to our development process, and seeing it in action has given me an even greater appreciation for what the team is building.Having personally watched the evolution of this platform, I'm especially excited to see this launch. Huge congratulations to @intesar_mohammed1 and the entire team. Beyond building a great product, they're genuinely friendly people and a pleasure to work with. Looking forward to seeing where Perfai goes from here! 🚀

As someone who watches teams ship fast with AI tools, closing the security gap before production without needing a dedicated security hire is exactly the kind of operational leverage I want.

this is a real gap. so many vibe-coded apps ship with auth or row-level security completely missing because the tool never surfaced it as a decision point. curious how deep the "fix" side goes though - does it actually patch broken access control rules in the code, or mostly flag the issue and leave the fix to you

Congrats on the launch!! this hits such a real gap honestly, so many people are shipping vibe-coded apps fast with replit/lovable/cursor and just... not thinking about access control until something breaks.

paste-a-url-get-live-vulnerabilities is such a low-friction way to make security actually happen instead of being this thing people mean to get to eventually. rooting for you all.

Hi Qutub Syed, nice idea and the site looks good, I like the “test a live app by URL” approach, especially for small builders who don’t have a security team.I tried entering my app URL and clicking “Test now”, but nothing seemed to happen on my end. I may be missing a step, or it could be a browser issue. Just wanted to flag it in case it helps with the launch feedback.

The “paste your app URL” workflow is appealing because it removes a lot of the friction around security testing. I’m wondering how you decide which vulnerabilities to prioritize first—do you rank them by severity, exploitability, or something else?

This is the right problem to aim at. The scary part of AI-built apps is not the rough edge in the UI; it is the invisible permission model across pages, APIs, and data. A useful security pass has to prove what each role cannot do, not just what the happy path can do.

vibe coded apps have a real security problem that nobody talks about enough. the same speed that lets you ship in hours also means access control and input validation are usually the last things anyone thinks about. autonomous fixing is the interesting part here though. most security scanners find vulnerabilities and then leave you to figure out the fix. does perfai actually apply the fix to the codebase directly or does it generate a patch you review first before anything changes?

Scanning live deployed vibe apps rather than static source is the right call. Most tools miss runtime behavior entirely. We've run into situations where AI-generated code introduces subtle auth gaps that only surface under specific API call sequences. How does your scanner handle stateful multi-step exploits? Can it chain requests across endpoints to trigger a vulnerability that no single request would expose?

If UI hides an admin route that's still live on the backend, does Vision Agent even catch it?