About the VibeScan scanner

VibeScan is a deterministic security scanner. It checks a website for things like missing security headers, exposed source maps, known- vulnerable JavaScript libraries, and leaked credentials, the same checks a security-conscious engineer would run by hand.

Why this traffic exists

Every scan is owner-initiated: it only happens because someone entered a URL into vibe-scan.net themselves. VibeScan does not crawl the web or scan sites on its own schedule. There is no autonomous or recurring scanning behind this traffic. One scan can involve a handful of requests in quick succession (the page itself, a few of its same-origin scripts, and a source map if one is present), all carrying the same User-Agent. We rate-limit how often the same site can be scanned (at most 3 scans an hour and 10 a day), so if the request in your logs repeats within those limits, that reflects someone re-running the tool against your site, not VibeScan acting on its own.

Where the traffic comes from

vibe-scan.net itself runs on Fly.io. The outbound requests made during a scan (fetching the target page, its scripts, and any source map) come from a separate, dedicated host, not from Fly.io's network. Every scan is still triggered by the same vibe-scan.net site, just carried out over a different outbound connection. If the request you saw doesn't appear to come from a Fly.io IP range, that's expected, not spoofing.

Contact

Questions, concerns, or a request that we stop scanning your site, reach us at [email protected]. Today this is handled manually: we add your domain to our blocklist by hand, the same way any other unsupported target is excluded. For how we handle data, see our privacy notice.

Last updated: 2026-09-26