How to Read Your SimplyScan Security Report

Quick answer: A SimplyScan report is a prioritized action list for your vibe-coded application. It provides a security score from 0 to 100, categorizes findings across 8 dimensions (security, speed, SEO, AEO, accessibility, compliance, domain, and email), and assigns four severity levels from Critical to Low. To secure your app, you must revoke exposed secrets immediately.

By Daniel A · Kraftwire Software

A SimplyScan report is a prioritized action list for your vibe-coded application. It provides a security score from 0 to 100, categorizes findings across 8 dimensions (security, speed, SEO, AEO, accessibility, compliance, domain, and email), and assigns four severity levels from Critical to Low. To secure your app, you must revoke exposed secrets immediately, fix authentication and injection flaws within 48 hours, and address configuration gaps like missing security headers before your next production deploy.

What Does Your SimplyScan Report Cover?

You ran a scan on SimplyScan and received a comprehensive report. Now you are looking at a dashboard filled with scores, severity levels, and technical recommendations. For developers using "vibe-coding" tools like Cursor, Windsurf, or Lovable, this report is the bridge between a functional prototype and a production-ready application.

This guide walks you through every section of your report so you can interpret these findings and secure your application effectively. Understanding the nuances of these reports is essential because AI-generated code often contains "hallucinated" security patterns that look correct but fail under real-world scrutiny.

How Does the Security Score Work?

At the top of your report is a primary score from 0 to 100. This is a weighted average of your performance across the eight dimensions SimplyScan evaluates. It is designed to give you an "at-a-glance" health check of your entire digital presence.

What the Score Means

• 90-100 (Excellent): Your application has strong security fundamentals. Any remaining findings are typically informational or low-severity best practices. You likely have active RLS, no leaked secrets, and a solid Content Security Policy.
• 70-89 (Good): A solid baseline with some gaps. Most findings at this level are medium-severity issues, such as missing security headers, suboptimal performance, or minor accessibility issues.
• 50-69 (Needs Work): Significant security or performance issues are present.
• Below 50 (Critical): Your application has immediately exploitable vulnerabilities or major infrastructure failures. This might include exposed database credentials or a complete lack of SPF/DKIM records. Prioritize these fixes before allowing any user traffic.

How the Score Is Calculated

The score starts at 100 and applies deductions based on the severity and volume of findings. A single Critical finding, such as an exposed Stripe secret key, can drop your score by 15-25 points because it represents a total compromise of a specific system. Conversely, multiple Low severity findings, like missing alt text on a logo, might only deduct 1-2 points each. The goal is to reflect the actual risk profile of your application rather than just counting the number of errors.

The 8 Dimensions of a SimplyScan Audit

Unlike traditional scanners that only look at code or only look at SEO, SimplyScan audits the entire "site health" of an AI-built app in one pass. This holistic approach is necessary because AI tools often neglect the "boring" parts of deployment like email security or accessibility.

1. Security

This is the core of the report. It detects exposed API keys, broken authentication, and XSS vulnerabilities. It specifically looks for "vibe-coding" mistakes, such as leaving a database connection string in a client-side useEffect hook or failing to enable Row Level Security (RLS) on a Supabase backend.

2. Speed

Performance is a security feature; slow apps are vulnerable to Denial of Service (DoS) and provide poor user experiences that drive users away. We check for blocking I/O, unoptimized assets, and Core Web Vitals. High-performance apps typically rank better and are more resilient under heavy load.

3. SEO

Standard Search Engine Optimization checks ensure your app is indexable. This includes meta tags, sitemap presence, and header structures. If your AI-built app is a "Single Page Application" (SPA) that doesn't handle meta tags correctly, your SEO score will reflect that. You can use our meta tags generator to fix these issues.

4. AI Visibility (AEO)

Answer Engine Optimization (AEO) is a new frontier. SimplyScan checks if your site is readable by LLMs like ChatGPT and Claude. This involves checking for robots.txt permissions for AI crawlers and structured data. If your site is a "black box" to AI, you won't appear in AI-generated answers.

5. Accessibility (WCAG)

We scan for WCAG compliance, including color contrast and aria-labels. This is critical for both legal compliance and reaching a broader audience. AI tools often generate beautiful UI that is completely inaccessible to screen readers; this section helps you find those gaps. Use our color contrast checker for manual verification.

6. GDPR & Compliance Signals

This section looks for privacy policies, cookie consent mechanisms, and other signals required for global compliance. While not a legal substitute for a lawyer, these signals indicate whether your app is respecting user privacy standards.

7. Domain Health

Checks your SSL/TLS configuration and domain expiration. A misconfigured SSL certificate can lead to "Your connection is not private" warnings that kill user trust. You can use our SSL Checker for deeper dives into your certificate chain.

8. Email Security (SPF/DKIM/DMARC)

Crucial for preventing your app's transactional emails from hitting spam folders. We verify that your DNS records are correctly configured to prevent spoofing. If you are sending emails via Resend, Postmark, or SendGrid, these records must be perfect. Check your setup with our email security tool.

Understanding Severity Levels

Each finding in your report is assigned a severity level to help you prioritize your engineering time. This is the most important part of the report for developers who need to move fast.

Critical Severity

These are "stop-everything" issues. They represent vulnerabilities that are trivial to exploit and lead to immediate data loss or financial theft.

• Exposed Secrets: Finding a STRIPE_SECRET_KEY or OPENAI_API_KEY in your frontend bundle.
• Broken Auth: Routes that should be private but are accessible without a token.
• Database Exposure: Exposed service-role keys that bypass all security.

Action: Fix these immediately. Revoke the exposed key in your provider's dashboard, rotate it, and move it to environment variables on the server side.

High Severity

Serious vulnerabilities that are slightly harder to exploit than critical ones but are still dangerous and likely to be targeted by automated scanners.

• Missing RLS: Database tables that allow anyone to read or write data because Row Level Security is disabled.
• Code Injection: Patterns that could allow an attacker to execute scripts or manipulate database queries.
• Missing Security Headers: Lack of CSP or HSTS, leaving users vulnerable to man-in-the-middle attacks.

Action: Fix within 24-48 hours. These are the primary targets for automated bot scanners that roam the internet looking for new apps.

Medium Severity

Weaknesses that degrade your security posture or performance but don't lead to an immediate total compromise.

• Insecure Cookies: Missing HttpOnly or Secure flags on session cookies.
• Slow Load Times: Large unoptimized images that slow down the initial paint.
• Missing Meta Tags: Issues that prevent your app from looking good when shared on social media.

Action: Fix within the current sprint or week. These are important for the long-term health and professional feel of your application.

Low / Informational

Best practice recommendations that don't pose an immediate threat but should be addressed for a "perfect" score.

• Suboptimal Headers: Using X-Frame-Options instead of a more modern CSP frame-ancestors directive.
• Minor SEO Improvements: Missing alt text on decorative images.
• Redundant Code: Unused CSS or JS that slightly increases bundle size.

Action: Address during routine maintenance or when you have a "cleanup" day.

How to Read an Individual Finding

Every finding in the SimplyScan report is designed to be actionable for both humans and AI agents (like Cursor or Windsurf).

• The Title: A concise summary (e.g., "Missing Content-Security-Policy").
• The Evidence: The specific URL, line of code, or network response where the issue was detected. This is the "proof" that the issue exists.
• The Risk: An explanation of what an attacker could do if this isn't fixed. This helps you explain the importance of the fix to non-technical stakeholders.
• The Fix: A step-by-step instruction or code snippet to resolve the issue. You can copy this directly into your AI chat to ask it to "Apply this fix from my SimplyScan report."

Prioritizing Your Fixes: A Step-by-Step Plan

Don't try to fix everything at once. Follow this hierarchy of needs to ensure you are protecting your users first and optimizing for Google second:

• Secrets First: Use our guide on fixing exposed API keys. If a key was exposed, it is compromised. You must revoke it in the provider's dashboard (e.g., OpenAI or Stripe) before moving it to the backend. Simply removing it from the code is not enough.
• Authentication & Authorization: Ensure your Supabase or Firebase rules are actually protecting your data. Test your endpoints with a tool like Postman to ensure unauthenticated requests are blocked.
• Security Headers: Implement a strong CSP to mitigate XSS and clickjacking. This is often a single configuration change in your next.config.js or vercel.json. Use our CSP generator to create a policy.
• Performance & SEO: Once the "doors are locked," optimize for speed and search visibility. Use the specific asset recommendations in the Speed section to shrink your bundle size.

Why You Must Rescan After Deploying

A security report is a snapshot in time. Because AI-built apps evolve rapidly · often with dozens of deploys per day · vulnerabilities can be introduced as quickly as they are fixed. A single "vibe" that changes a layout might accidentally expose a hidden admin div or remove a critical meta tag.

SimplyScan offers 2 free rescans with every free scan. After you apply a fix and deploy it to your production or staging environment, run a rescan to verify:

• The exposed secret is gone from the bundle and no longer detectable.
• The new security header is being correctly served by your CDN (like Vercel or Netlify).
• The performance optimization actually improved your load times in a measurable way.
• The accessibility fix (like adding an aria-label) is now being picked up by the scanner.

For professional teams, Pro Monitoring provides scheduled rescans and uptime monitoring to ensure that a "vibe-coded" update doesn't accidentally drop your security score back to 50 while you aren't looking.

Key Takeaways for Vibe Coders

Your SimplyScan report isn't just a list of errors; it's a roadmap to a professional-grade application. AI tools are excellent at writing functional code, but they often prioritize "making it work" over "making it secure." They might use dangerouslySetInnerHTML to get a feature working quickly, or skip the complex setup of DMARC records.

By using this report to audit your Bolt.new, v0, or Replit projects, you ensure that your innovation isn't undermined by preventable security flaws. A high score on SimplyScan is a signal to your users, investors, and yourself that your app is built on a solid, secure foundation.

Run a free scan now to see where your application stands and get your prioritized fix list.

Related Guides

• The Ultimate Vibe Coding Security Checklist
• How to Fix Exposed API Keys in 5 Minutes
• Understanding Supabase RLS Policies
• AEO: How to Rank in AI Search
• Application Security Audit Checklist
• Windsurf Security Risks & Mitigation