VulX
Scans AI-generated codebases for exposed keys, vulnerable dependencies, and authorization flaws, with plain-English fixes.
🔗 Visit VulX
Description
AI coding assistants are great at shipping features fast and notoriously bad at remembering to check who's allowed to see what — the kind of mistake that lets anyone view someone else's data just by changing an ID in the URL. VulX exists specifically to catch the security gaps that "vibe coding" tends to leave behind.
VulX reads an entire application's codebase to check for exposed keys, vulnerable dependencies, insecure storage rules, and injection vulnerabilities, with particular focus on authorization flaws — routes that hand over any record to anyone who edits the ID in the URL, a pattern that has affected several high-profile AI-built apps. The free "Watch" tier connects to a GitHub repository and runs recurring scans, including CVE checks twice daily, secret detection, and a three-model consensus approach designed to reduce false positives before a finding reaches human review. Findings come with exact file and line locations and plain-English explanations of how to fix them, and an API is available for wiring automated security checks into CI/CD pipelines; a scoped Enterprise engagement covers deeper, hands-on application review.
💬 Our review
The short version: VulX targets a real and underrated risk — the class of authorization bugs (routes that hand over any record to anyone who edits the URL) that repeatedly show up in AI-generated code and that traditional dependency scanners don't catch, because it's a logic flaw, not a known CVE.
Its free "Watch" tier connects to a GitHub repo and runs recurring scans (secrets, vulnerable dependencies, twice-daily CVE checks) with a three-model consensus meant to cut false positives and human review of critical findings — a sensible design for a category where false alarms erode trust fast. The honest limitation: Watch doesn't inspect a running application or its database, so it can flag a vulnerable code pattern but can't confirm whether it's actually exploitable in production, and its checks run periodically rather than in real time. The Enterprise tier looks more like scoped security consulting than a self-serve product, which is fine for larger orgs but means smaller teams are really evaluating the free Watch tier alone — worth doing, since a purpose-built AI-code scanner beats hoping your AI assistant remembered to check permissions.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Watch : gratuit pendant la bêta, sans carte bancaire requise. Enterprise : tarif sur devis, engagement scopé par application.
Pros
Cible spécifiquement les failles d'autorisation (IDOR) fréquentes dans le code généré par IA
Vérifications CVE deux fois par jour + détection de secrets exposés
Consensus à trois modèles pour réduire les faux positifs
Explications en langage clair, localisation précise (fichier + ligne)
Cons
Watch n'accède pas à l'application en cours d'exécution ni à sa base de données
Scans périodiques, pas de surveillance en temps réel
Enterprise ressemble à du conseil sécurité scopé, pas un produit self-service
Produit jeune, peu de retours d'expérience indépendants