Question 1

What is a vibe-coded app?

Accepted Answer

A vibe-coded app is software built quickly with AI coding assistants. That speed often ships risky defaults: hardcoded API keys, wildcard CORS, debug mode left on, and missing security headers. Wardloom is a defensive launch checker made to catch those oversights before launch.

Question 2

What does Wardloom check before deployment?

Accepted Answer

Wardloom covers twelve security check families: secrets, CORS, security headers, dependency CVEs, config exposure, auth and session flaws, IDOR and ownerless endpoints, debug artifacts, deployment readiness, LLM and agent security, plus advisory traffic-readiness and legal/privacy signals. On live URLs it also runs deterministic SEO and GEO/AEO audits, Core Web Vitals, and a light crawl. Verify control of your domain and eight read-only live deployment checks unlock on top.

Question 3

Is Wardloom safe? Does it store my code?

Accepted Answer

Yes. Wardloom is a strictly benign, read-only tool for reviewing code and deployments you own. It never executes your code, never runs exploits, and never fuzzes your application. Submitted code goes to the analyzer transiently and is never written to a database, and secret values are redacted before anything is stored or displayed.

Question 4

What is the Ship-Readiness score?

Accepted Answer

Ship-Readiness is the headline of every Wardloom report: one number that answers whether an app is finished and safe to launch. On repository scans it combines the deterministic Vibe-Check Security Score (0 to 100, weighted 65%) with a Completion Score (35%), and it can never read higher than the security score while a critical or high finding is open, coverage was truncated, or the authorization surface went untested. Alongside it sits a pass, warn, or block gate and Launch Confidence, which weights security, SEO, health, and GEO.

Question 5

What are verified-deployment checks?

Accepted Answer

Verified-deployment checks are eight live checks that run only after you prove you control the domain, using a DNS TXT record or a file at a /.well-known path. They cover dangling DNS records, exposed administration routes, directory listings, GraphQL introspection, public API documentation, HTTPS enforcement, TLS certificate health, and verbose error pages. All of them are read-only GET requests and DNS lookups against a fixed path list — never fuzzing, never an exploit attempt.

Question 6

Can Wardloom run inside Claude Code, Cursor, or another AI coding agent?

Accepted Answer

Yes. Wardloom ships an MCP server — npx -y wardloom-mcp — that connects to Claude Code, Cursor, and any MCP client. It exposes seven tools: local_precheck for a fast scan that stays on your machine, start_scan and get_scan_status, check_deploy_ready for the ship gate, get_findings, get_remediation_roadmap, and get_handoff_prompt. Create an API key from your dashboard, paste one config block, and tell your agent to check the app before it ships. API access is available on every plan.

Question 7

Can Wardloom gate my CI pipeline?

Accepted Answer

Yes. The Wardloom Ship-Readiness Gate is a GitHub Action that scans a repository or a deployed URL on every pipeline run and fails the build when the result falls below your score threshold. The same endpoints are available directly as an authenticated HTTP API, with idempotency keys, stable error codes, and a scan-to-scan delta so you can see what changed since the last run.

Question 8

How do I fix the issues Wardloom finds?

Accepted Answer

Every report includes a phased remediation roadmap ordered by severity and effort, plus a copy-pasteable Dev/AI handoff prompt — a benign, defensive refactoring request you can paste into Cursor or Claude, or hand to a teammate. On Pro, Guided Fixing proposes validated diffs and rescans afterwards to confirm the issue is actually gone. Reports export to PDF and HTML, and every one states plainly what was not tested.

Question 9

Does Wardloom keep checking after I launch?

Accepted Answer

Yes. Turn on monitoring for a project and Wardloom re-scans it daily or weekly, emails you when something regresses, and sends a monthly summary. Scan-to-scan comparison shows what was fixed, what is new, and what is still open, and Pro and Team can publish a shareable Ship-Readiness certificate that carries scores and coverage honesty without exposing any finding detail.

Whichever AI tool you build with, the last gate looks the same.

Lovable

Is your Lovable app secure enough to launch?

Is your Lovable site actually finished, or does it just look done?

Does your Lovable app protect its Supabase data with real RLS rules?

Bolt

Is your Bolt app secure enough to launch?

Is your Bolt site actually finished, or does it just look done?

Does your Bolt app protect its Supabase data with real RLS rules?

v0

Is your v0 app secure enough to launch?

Is your v0 site actually finished, or does it just look done?

Does your v0 app protect its Supabase data with real RLS rules?

Replit

Is your Replit app secure enough to launch?

Is your Replit site actually finished, or does it just look done?

Does your Replit app protect its Supabase data with real RLS rules?

Cursor

Is your Cursor app secure enough to launch?

Is your Cursor site actually finished, or does it just look done?

Does your Cursor app protect its Supabase data with real RLS rules?

Windsurf

Is your Windsurf app secure enough to launch?

Is your Windsurf site actually finished, or does it just look done?

Does your Windsurf app protect its Supabase data with real RLS rules?