Test Your Vibe-Coded App Like a Hacker Before You Ship It

WatchInstagram

Your vibe-coded app works on your laptop. That doesn't tell you whether signup breaks for a real user, whether the AI agent inside it behaves, or what a hacker would find. Four free tools check all of that before launch.

e2e clicks through your app from a goal you write in plain English. iFixAi audits the AI agent inside your app. PentAGI attacks a staging copy of your own app the way a hacker would, then lists what it finds. And Rust's compiler refuses to build many classes of bugs before your code ever runs.

Below is what each one checks, and how to set it up.

What does each tool check before you launch?

e2e: click through your app like a customer

e2e, from TesterArmy, has over 11,000 stars on GitHub. You describe a goal in plain English, like "sign up with this email", and an AI agent clicks through your app to do it, so you find the broken button before a real user does. It works on websites and mobile apps.

Once a step passes its check, e2e records what the agent did and replays it with no model calls until your app changes. Agent steps need a model: your own subscription, an API key or a local model.

iFixAi: audit the AI agent inside your app

If your app has an AI agent inside, iFixAi audits it and gives you a grade. It checks for things like the agent making facts up, manipulating users, or handing one user's private details to another. Its default run answers in under 120 seconds, and it has over 30,000 stars.

For a grade you can rely on, it needs keys from two different AI providers: one runs your agent and the other judges it.

PentAGI: attack your own app like a hacker would

PentAGI is a team of AI agents that runs a penetration test. Point it at a staging copy of your own app and it probes it with real security tools inside a sandbox, then writes up the weaknesses it finds, without you paying a pen-tester. It has over 31,000 stars and works with models from OpenAI, Anthropic and Google, or a local model through Ollama.

Only ever test apps you own or are authorised to test. Its own README says the same, and testing someone else's site without permission is against the law in most countries.

Rust: stop whole classes of bugs before they run

Rust is a programming language with over 120,000 stars on GitHub. Its type system and ownership model guarantee memory safety, so the compiler refuses to build code with many classes of bugs, including ones your AI wrote that you'd never spot. Apps built in it also run fast.

It won't catch every bug, so keep testing with e2e.

How do you set up each one?

e2e. Run this in your project. It asks for web or mobile and a model provider, then writes a config and an example test. On Windows, use WSL.

npx e2e init

Tests are TypeScript files with plain-English goals inside. Here's a signup test in e2e's documented format. Change "Dashboard" to the heading your app shows after signup, and if your form asks for a password, pass it as a Secret (see e2e's Signing in docs).

// tests/signup.e2e.ts
import { test, expect, unique } from 'e2e';
 
test('a visitor signs up and reaches the dashboard', async ({ app, agent, screen }) => {
  await app.open('/');
 
  const email = `ada+${Date.now()}@example.test`;
  await agent.act('sign up with email {email}', { params: { email: unique(email) } });
 
  await expect(screen.getByRole('heading', 'Dashboard')).toBeVisible();
});

Run your tests with npx e2e run before every deploy. e2e is still on its way to version 1.0, so its commands can change.

iFixAi. Install it with the extra for your AI provider, then follow the guided setup:

pip install "ifixai[anthropic]"
ifixai setup
ifixai run

In Claude Code, you can add it as a plugin instead, then run /ifixai:ifixai:

/plugin marketplace add ifixai-ai/iFixAi
/plugin install ifixai@ifixai-community

PentAGI. Four steps:

1. Install Docker. PentAGI needs at least 2 CPUs, 4 GB of RAM and 20 GB of free disk.

2. Install PentAGI with the interactive installer or the Docker Compose steps in its README. On Linux, the installer is:

   Copy

   mkdir -p pentagi && cd pentagi
   wget -O installer.zip https://pentagi.com/downloads/linux/amd64/installer-latest.zip
   unzip installer.zip
   ./installer
   

3. Open https://localhost:8443, sign in with the default admin account from the README, and change its password straight away.

4. Add your model key, or point it at Ollama for a local model, and give it only a staging copy of your own app as the target.

Rust. On macOS or Linux, install it with the official one-liner. On Windows, download and run rustup-init.exe from rust-lang.org.

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Then add one line to your next Claude Code prompt for a small tool or script:

Build this in Rust.

For the scanners that check your code before it goes to GitHub, see our free app security scanners. To find where AI could save your team the most time, take the free AI bottleneck test, or read our insights on AI implementation.