The latest articles on DEV Community by Hamza (@hamza_1ffb347ba7c946f7fdd). https://dev.to/hamza_1ffb347ba7c946f7fdd https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3890785%2Fdff8ed09-9c4d-4647-b073-9d334891af8b.png https://dev.to/hamza_1ffb347ba7c946f7fdd en Hamza Tue, 21 Apr 2026 12:40:30 +0000 https://dev.to/hamza_1ffb347ba7c946f7fdd/i-built-a-security-scanner-that-outputs-claude-code-prompts-to-fix-each-vulnerability-25n5 https://dev.to/hamza_1ffb347ba7c946f7fdd/i-built-a-security-scanner-that-outputs-claude-code-prompts-to-fix-each-vulnerability-25n5 <h1> I built a security scanner that outputs Claude Code prompts to fix each vulnerability </h1> <h2> The problem </h2> <p>Every security scanner I tried fell into one of three buckets:</p> <ol> <li>Enterprise-priced — Qualys, Detectify, Snyk enterprise: $1k-10k/year. Overkill for a solo project.</li> <li>DIY — OWASP ZAP, Burp Suite: great, but a full weekend to set up and tune.</li> <li>Free but useless — SSL Labs, Mozilla Observatory: "you're B-rated." Ok, but what do I actually change?</li> </ol> <p>As a solo dev shipping fast, I wanted something in the middle. So I built ScanMyVibe.</p> <h2> What it does differently </h2> <p>Every scan returns:</p> <ul> <li>Severity-ranked vulnerabilities</li> <li>A ready-to-paste Claude Code prompt per issue — literally the one-liner you drop into Cursor/VS Code that fixes it</li> <li>PDF report for compliance trail</li> </ul> <p>Example output for a missing CSP header:</p> <blockquote> <p>Add the following Content-Security-Policy header to your Next.js next.config.js middleware: default-src 'self'; script-src 'self' 'nonce-{NONCE}' 'strict-dynamic'; ...</p> </blockquote> <p>No interpretation needed, no "go read the MDN docs."</p> <h2> Stack </h2> <ul> <li>Next.js 15 App Router + Prisma + Railway</li> <li>Custom checks: HTTP headers, SSL/TLS config, cookie flags, exposed env vars, common misconfigurations</li> <li>AI-generated fix prompts per vulnerability class (cached, not real-time LLM)</li> <li>NextAuth v5 for optional accounts</li> <li>Stripe for PRO tier ($29/mo: scheduled monitoring + breach alerts on your stack)</li> </ul> <h2> Try it </h2> <p>Free, no signup needed for first 3 scans: <a href="https://scanmyvibe.co" rel="noopener noreferrer">scanmyvibe.co</a></p> <p>Would love feedback:</p> <ul> <li>Which checks am I missing?</li> <li>Which fixes are too noisy or incorrect?</li> <li>Is $29/mo PRO priced right for indie devs?</li> </ul> webdev security saas ai