Questions and answers
What does vibe coding mean?
You describe an app to an AI coding assistant, which helps write the implementation. Generated code still needs security review.
Can I check my application source?
Use Public repository to analyse a public repository after signing in, or Pasted code to submit a snippet. Repository scans save a private report and require a configured backend. Private repositories are not supported.
Which app builders can I use with Noxarix?
You can submit apps built with Lovable, Bolt or Cursor, as well as hand-written projects. Choose a website URL, public repository or pasted code; available checks depend on that input.
When will my scan finish?
Duration depends on the target, network responses and enabled engines. Repository analysis can take several minutes. Follow progress on the scan screen; incomplete checks are identified in the report.
Does Noxarix offer Go or Pro subscriptions?
No. The current Noxarix scanner does not have Go or Pro plans. Choose the scan mode that matches your target: Website URL, Public repository or Pasted code.
How is this different from a header-only check?
Headers are one part of a URL scan. Noxarix also checks supported secret patterns and infrastructure signals. Repository mode adds source, dependency, container and git-history checks with enabled engines.
Can I scan a production website?
Scan only targets you own or are authorised to test. Requests may appear in logs or trigger rate limits. Review the scan options before starting.
What kinds of issues appear in a report?
Findings can include exposed secrets, token weaknesses and supported backend misconfiguration. Each report provides evidence and fix guidance; skipped checks, errors and timeouts remain visible.
How should I check database access permissions?
Test access as a signed-out visitor, the intended owner and another user. Keep server secrets out of client code. A scan cannot verify every permission rule.
Does a clean report mean my app is secure?
No. A report covers supported checks against the input available at that moment. Skipped checks, errors and timeouts are shown separately from findings.
Where does my input go?
URL, Repository and Code scans run on our server. Code is sent to the scanner; repositories are analysed in a temporary copy. Supported checks run automatically, including detected service access and key verification. Individual tools show whether they use the browser or the server.
Are saved reports private?
Yes. Saved reports require the owner’s verified sign-in. Public sharing is disabled. Old anonymous report links no longer open.
Can I scan without an account?
URL and Code scans do not require an account and are not saved unless you choose saving and sign in. Repository scans require sign-in and save a private report. Storage requires a configured backend.
Will Noxarix fix my code automatically?
No. You get explanations, fix prompts and available code examples. Apply and test the changes yourself, then run another scan. A copied prompt does not mark a finding as fixed.