Replay
Autonomous app testing
Start new thread

Replay QA Security Scan - Automated Penetration Testing for AI-Built Apps

by
•
Replay pentests your web app on every QA pass now: injection flaws, broken access control, IDOR, the stuff AI-generated code tends to miss. Findings come back as full bug reports, evidence and suggested fix included. Schedule it daily or weekly and skip the "remember to test" step. You wake up to a queue of bugs already triaged. Same projects also test against dev, staging, prod, and localhost, so you're not maintaining separate QA setups per environment.

Add a comment

Replies

Best
Maker
📌

Hey Product Hunt,

Kevin here from .

AI coding tools are good at making things that work. Security intuition is different, built from years of pentesting experience, and it's not something these models reliably apply yet. Agents write API endpoints that return the right data, not endpoints that check who's asking for it. That gap is where IDOR, broken access control, and injection flaws come from, and we kept seeing it in apps our own QA agents were testing.

So we built Security Scan into Replay QA. It runs a real pentesting pass against your live app, actual attack payloads, and turns findings into a report: the vulnerability, how it was triggered, what an attacker could do, and what to fix.

One catch: since it sends live attack traffic, the first run requires ownership verification. Non-negotiable, we're not running exploits against apps people don't control. Runs on the same schedule as the rest of Replay QA (every push, every PR, or a fixed cadence), so it's not something you have to remember to kick off.

Try it here:

Happy to answer questions all day and curious what you find if you point it at something you've shipped.

Great launch, much needed.. good wishes for your success.. on lighter note, imagine the flags being raised, if your system was named "AI Hacker for your AI apps"

The deterministic runtime recordings sound really useful. Being able to replay exactly what happened when a bug appears could make debugging much easier.

the failure i would want covered is the one that only exists across two passes. idor and broken access control usually look fine when you scan one account, because the bug is that account a can reach account b, and a single session never notices.