FlawPilot is a free scanner for AI-built and vibe-coded apps. Paste a URL and get scored results across security, performance, infrastructure and technical SEO. Connect a repo and it also scans your source code. Every finding comes with a ready-to-apply fix, explained in plain English.
What is FlawPilot?
FlawPilot checks a live site and its code for the problems that AI-generated apps commonly ship with. You get 117 checks without signing in, and a free account runs 137+ checks and keeps every scan.
Built for AI-built apps
Tools like Lovable, v0, Bolt.new, Replit and Cursor ship fast, and the defaults are not always safe. Typical finds include missing DMARC records, weak security headers and misconfigured Supabase storage. FlawPilot has scanner pages for each of these platforms.
What does it check?
- Security: headers, TLS, CSP, CORS, SPF, DKIM and DMARC
- Performance: Core Web Vitals (LCP, INP, CLS), page weight, render-blocking assets and caching
- Infrastructure and DNS: CDN and WAF detection, DNS health, exposed services and ports, subdomain and edge hygiene
- Technical SEO: titles, meta tags, headings, canonicals, robots, sitemap, schema, crawlability and AI-readability
- Source code: connect GitHub, GitLab or Bitbucket to scan for insecure code, exposed secrets, vulnerable dependencies and code quality, each scored separately
Who is it for?
Founders and solo builders shipping with AI tools, developers who want a pre-launch check, and agencies reviewing client sites.
What can you do with it?
- Scan any URL for free, no signup needed
- Crawl a whole site with per-page Lighthouse results (Site Health)
- Get prioritized, plain-English fixes you can apply directly
- Gate deployments with CI/CD checks (GitHub Actions, GitLab CI, Bitbucket)
- Automate with the REST API
- Add a FlawPilot score badge to your site
- Request a manual pentest
Use it from your AI assistant
FlawPilot offers an MCP server for Claude Desktop and Claude Code, Cursor, VS Code Copilot and Antigravity, with setup guides for ChatGPT and Gemini. Ask your assistant: "Scan example.com with FlawPilot and summarize the critical findings."
Pricing
Free. Scan without an account, or sign up free for 137+ checks and saved scan history.
Alternatives
- SonarQube: FlawPilot is lighter, with no server to run, and it also checks your deployed site.
- Snyk, Wiz and CodeAnt AI: see the side-by-side comparisons at flawpilot.com.
- Lighthouse: Google's page-level performance and best-practices audit. FlawPilot's Site Health runs Lighthouse across every page of your site, then adds security, infrastructure, SEO and code scanning on top.
FAQ
Is FlawPilot free? Yes. Scanning is free, and a free account unlocks 137+ checks.
Do I need server access? No. Site scans run against the public URL. Code scanning connects to your repo through GitHub, GitLab or Bitbucket.
Does it scan the whole site? The quick scan covers a few representative pages. Site Health crawls every page.
Which AI app builders does it support? Lovable, v0, Bolt.new, Replit and Cursor.
