Don't trust the vibe. Test it.
LARP is the security testing layer for vibe-coded applications. Scan what your AI tool built for broken auth, exposed secrets, and insecure configs before your users do.
3
Scan depths: baseline, full, API
Full log
Every finding the scanner printed
What a report comes back as
Rules checked against your live app
Scanner
OWASP ZAP
Run for you on GitHub Actions
Baseline scan takes
5–10 min
PageSpeed Insights
Metrics
How it works
From vibe-coded to security-tested in three steps
Paste your URL
Sign in with GitHub or Google and give LARP the address of your deployed app. Nothing to install, no infra to stand up.
Pick how deep to go
Baseline crawls and reads responses without touching your app. Full scan attacks it with real payloads. API scan works from an OpenAPI, SOAP, or GraphQL definition.
Read the whole log
OWASP ZAP runs on GitHub Actions and streams its output straight back to you — every rule it passed, warned on, or failed, kept in your scan history.
Security tests
Everything vibe-coded apps tend to get wrong
AI coding tools optimize for working demos, not hardened production apps. LARP runs OWASP ZAP against your deployed app and reports what it finds — passively by default, or with real attack traffic when you ask for it.
Security headers
Missing CSP, HSTS, anti-clickjacking, X-Content-Type-Options, and Permissions-Policy.
Cookie handling
Cookies set without HttpOnly, Secure, or SameSite, and cookies scoped too loosely.
Information disclosure
Debug errors, stack traces, suspicious comments, and sensitive values left in URLs.
Vulnerable dependencies
Known-vulnerable JavaScript libraries shipped in your bundle, via Retire.js.
Cross-domain configuration
Over-permissive CORS and scripts pulled in from domains you do not control.
Transport & caching
Mixed content, HTTP-to-HTTPS form posts, and responses cached when they should not be.
Cross-site scripting
Reflected and stored XSS, probed with real payloads against your live app.
Injection
SQL, NoSQL, command injection, and path traversal, actively attempted.
API endpoints
Every route described by your OpenAPI, SOAP, or GraphQL definition, exercised in turn.
Ship fast. Break safely.
Sign in with GitHub or Google and get three scans a day, free. Or run a Lighthouse speed test right now without an account.
Pick your depth
3 a day