Prbl
Prbl is a security scanner built for AI-generated code. Paste a live app URL or a public GitHub repository and it flags hardcoded secrets, injection flaws and missing authentication, then rewrites the fix and proves the app still works.
What is Prbl?
Prbl is a security scanner aimed at one blind spot: the code that AI tools write for you. Its premise is that models behind Cursor, Claude Code, Lovable, Bolt or v0 fail in a narrow and repeatable set of ways. Hardcoded credentials land in a generated migration file. A scaffolded login endpoint concatenates strings into a SQL query. A JWT secret quietly falls back to a public default when the environment variable is missing. Generated CRUD routes ship with no authentication check. Webhook signatures are compared with a plain equality test. General-purpose scanners were tuned for dependency CVEs, not for that question.
The product runs a four-step loop. It detects the AI-generated files and scans them against 15 rule classes. It then captures a behavioural baseline of what those functions already do. On paid plans an AI rewriter writes the minimal fix and shows it as a diff you approve, the function in question being sent to Anthropic's Claude API for that step alone. Finally it re-scans and replays the baseline, so the fix is proven not to have broken the feature it lives in. Closing that loop is the vendor's central claim: other scanners stop at the finding.
A first result costs nothing. Paste a deployed app URL or a public GitHub repository and results come back in under a minute, with no account; private repositories need a GitHub sign-in. The scanner rules are open source under MIT and install locally with pip, so the code can stay on your machine.
Prbl publishes its own numbers and links its own proofs: 8M+ lines scanned in testing, 976 repositories stress-tested, 330 regression tests, plus third-party badges from Mozilla Observatory, the OpenSSF Scorecard, pip-audit and CodeQL. Its original research found a high-severity flaw in 31.6% of 976 repositories linked from Hacker News. The publisher, Wright Software Solutions, presents the tool as a complement rather than a replacement: keep Snyk, Semgrep or CodeQL, and run Prbl beside them.
What it does
- Detect which files in a repository were written by an AI coding tool and scan those first
- Find hardcoded secrets, SQL and NoSQL injection, missing authentication on generated routes and weak crypto
- Scan a deployed application from its public URL for exposed keys and misconfigurations
- Capture a behavioural baseline of the code before anything is changed
- Rewrite the vulnerable code with an AI fix and present it as a diff to approve
- Prove the fix preserved existing behaviour, then re-scan to confirm the finding is gone
- Keep a scan history and an audit log across a team
When to use Prbl / When not to
A quick filter to help you decide if Prbl is the right fit.
When to use Prbl
- Solo founders and two-person teams shipping fast with Cursor or Claude Code, with no security review process of their own
- Developers who accepted AI-generated files without reading every line and want a first pass before shipping
- Engineering teams already running Semgrep, Snyk or CodeQL who want the extra layer aimed specifically at AI-written code
- Startups preparing a SOC 2 audit who need a baseline scan, a remediation trail and a scan history as evidence
- Users of AI app builders such as Lovable, Bolt, v0, Replit or Base44 who never see the code that was generated for them
When not to use Prbl
- Teams whose main need is dependency or SCA scanning: the vendor states plainly this is not what Prbl does
- Anyone looking for container image or infrastructure-as-code checks, which Prbl does not perform at all
- Organisations that need a formal security audit or penetration test, which the terms explicitly say Prbl does not replace
- Buyers who require a signed DPA, a named GDPR representative or a documented hosting jurisdiction, none of which the site publishes
- Anyone under 18, or anyone wanting to scan repositories they neither own nor have written authorisation to test
How to use Prbl
A typical end-to-end flow, from setup to results.
- Open the free scan page and paste either the public URL of your deployed app or the URL of a public GitHub repository
- Run the scan with no account and no installation; results come back in under a minute
- Read each finding: exact file, line number, rule matched, and a plain-language explanation of why it matters
- Sign in with GitHub OAuth if you need to scan a private repository
- On a paid plan, trigger the AI rewriter on a finding and review the diff it proposes
- Check the behavioural baseline result, which shows whether the fix preserved what already worked
- Approve the diff, then re-scan to confirm the finding is gone and the baseline tests still pass
- Consult the scan history and audit log to track what has been remediated over time
- Install the open-source scanner locally with pip if you would rather never send code to the vendor
- Wire the GitHub Action into your pipeline so new AI-generated code is checked on every push
Pros & Cons
Pros
- Closes the loop from finding to verified fix, where competing scanners stop at the report
- Free scan with no account, no installation and a result in under a minute
- Permanent free plan covering 10 scans a month across 3 repositories
- Scanner rules are open source under MIT and can run entirely on your own machine
- No source code storage: the clone is deleted right after the scan and no secrets found are logged
- Code and scan results are explicitly never used to train AI models
- Third-party proofs are published and linked, including Mozilla Observatory, OpenSSF Scorecard, pip-audit and CodeQL
Cons
- No dependency, container or infrastructure-as-code scanning, so it cannot be your only security tool
- The publisher discloses no postal address, no email address and no about page; contact goes through a form only
- No GDPR mention anywhere, no DPA and no hosting country stated beyond naming Hetzner Cloud
- GitHub OAuth is the only sign-in route, which rules out teams that do not host code there
- All payments are final: the terms exclude refunds, credits and prorated charges
- Using the rewriter sends the function being fixed to a third party, Anthropic's Claude API
- The domain and the legal documents both date from June 2026 and there is no archived history of the site
Pricing & Plans
Prbl offers a permanent free plan at USD 0 with no credit card required, covering 10 scans per month across 3 repositories. The lowest paid entry point is the Pro plan at USD 29 per month. All charges are billed in US dollars through Stripe, an annual commitment is advertised as giving two months free, and prices may change with 30 days' notice.
- no credit card needed
- 10 scans per month
- file and line-level findings
- open-source scanner rules
- 3 repositories
- 200 scans per day
- 50 rewriter credits per month
- unlimited repositories
- scan history and audit log
- 1
- 000 scans per day across the team
- 200 rewriter credits per month
- 10 team members
- shared dashboard
- priority support
- everything in Team
- 1
- 000+ rewriter credits per month
- unlimited members
- SSO and audit logs
- dedicated support
Data, GDPR & hosting
A consolidated view of how Prbl handles your data.
GDPR overview
There is no GDPR mention at all. The word does not appear anywhere on the site, including in the privacy policy, so there is neither a claim of compliance nor a denial of it. No legal basis, no data protection officer, no Article 27 EU representative and no data processing agreement are named. The policy does grant a set of rights that resemble the regulation's, introduced by the hedge "Depending on your location, you may have the right to": access, correction, deletion, portability and objection, all exercised through the contact form rather than a dedicated address. Retention is bounded at 30 days after account deletion. The publisher is American, the terms are governed by the law of the State of Georgia, and no European establishment or representative is disclosed. European buyers should treat the GDPR position as undocumented rather than settled.
Who owns the data?
The terms are unambiguous: you keep ownership of your code and your repositories. Connecting a repository grants Wright Software Solutions only a limited, non-exclusive licence to clone and analyse it for the purpose of running the service. Source code is not kept beyond the scan itself; the clone is deleted as soon as the scan finishes and, according to the trust page, no source code is stored anywhere. What is retained and tied to your account is the findings metadata: file path, line number, rule identifier, severity, description and timestamp. Those records sit in Supabase with row level security, so only you can read them, and you can delete the account and its data from Settings, permanently and irreversibly.
Reuse rights
Scan results belong to the account that produced them and can be reused freely: the privacy policy lists portability among your rights and lets you request your findings in a machine-readable format, with no permission to ask for. Nothing in the terms restricts what you do with a report internally, and the scanner rules themselves are open source under MIT, so you may run them on your own machine and keep the output entirely. On the vendor side the use is narrow: data serves to operate the service, authenticate you, bill you, send transactional email, improve scanner accuracy and enforce plan limits. The policy states that code and scan results are never used to train AI models and are not sold or shared with advertisers. The only code that leaves the vendor's own infrastructure is the single function sent to Anthropic's Claude API when you use the rewriter.
Data retention & training
Hosting summary
The site names its providers but never its jurisdiction. The privacy policy lists four third parties: Hetzner Cloud for infrastructure and scanner compute, Supabase for the database and storage, Stripe for payments and GitHub for authentication and repository access, each with a link to its own policy. No hosting country or region is disclosed for any of them, so the location of stored data has to be treated as undocumented. What is described is the handling: repositories are cloned to the vendor's own server, the scanner runs there, and the clone is deleted immediately afterwards, with no source code retained. Findings are stored in Supabase with row level security enabled, so each account reads only its own records. All traffic is over HTTPS, sessions are held server-side, and Stripe and database credentials are never exposed to the browser. The only code that leaves this perimeter is the individual function sent to Anthropic's Claude API when the rewriter is used. The front end resolves behind Cloudflare.
Things to keep in mind
Risks and trade-offs to weigh before adopting Prbl.
- The publisher is nearly anonymous: no postal address, no email, no about page and no public trace, which leaves the contact form as the only recourse
- GDPR is absent from the entire site, so European users have no documented legal basis, representative or processing agreement to rely on
- The hosting jurisdiction is never stated; only the infrastructure provider, Hetzner Cloud, is named
- Using the AI rewriter sends part of your code to a third party, which is disclosed but is still a boundary crossing worth a conscious decision
- A clean scan can breed false confidence: the vendor itself warns that scanning is probabilistic, with both false positives and missed vulnerabilities
- Approving AI-written fixes without understanding them replaces one blind trust with another and can erode a team's own security judgement
- Scanning a repository you do not own or are not authorised to test is prohibited by the terms and can carry legal consequences for you
Setup & Integrations
Technical difficulty
Very low to start. The first scan needs one pasted URL, no account and no installation, and returns in under a minute; every finding comes with a plain-language explanation, so no security background is required. Scanning a private repository adds a single GitHub OAuth sign-in. Difficulty rises only if you industrialise: running the open-source scanner locally means one pip install and a command line, and wiring the GitHub Action into a pipeline assumes ordinary CI familiarity. Reviewing and approving the rewriter's diffs remains a developer's job.
Deployment
Integrations
Behind Prbl
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Prbl.
Frequently asked questions
What does Prbl do that other security scanners do not?
Do I need an account to run a scan?
Is my source code stored?
Is my code used to train AI models?
Does Prbl replace Snyk, Semgrep or CodeQL?
Which vulnerabilities does it look for?
Can I run the scanner without sending my code anywhere?
What does it cost, and can I get a refund?
Is there a minimum age or an account requirement?
Is there a mobile app?
Should you pick Prbl?
Prbl is a deliberately narrow tool, and that is its strength. It asks a question general scanners do not: did an AI write this file, and does it carry the failure patterns AI tools repeat? The answer arrives fast, free and without an account, which removes almost every reason not to try it on a repository you shipped without reading line by line. The differentiator is the second half of the loop. Finding a hardcoded secret is easy; changing it without breaking the feature around it is the part that stalls. Capturing a behavioural baseline first, then proving the rewritten code still satisfies it, is a real answer to that problem rather than a marketing line. Publishing the scanner rules under MIT so anyone can run them locally, and linking third-party badges instead of asserting them, both point the same way. What should temper enthusiasm is everything around the product. Wright Software Solutions publishes no postal address, no email address and no about page; the domain was registered in June 2026, the legal documents took effect a day earlier, and the site has no archived history at all. GDPR is not mentioned once, there is no data processing agreement, and the hosting country is never stated. Payments are final with no refunds. None of that makes the scanner worse, but it does mean a regulated buyer has little to work with, and that anyone in Europe should ask questions before connecting a private repository. Used as the vendor recommends, as an extra layer beside Snyk, Semgrep or CodeQL rather than instead of them, Prbl fills a gap that is genuinely widening. Treat it as a fast, useful check on AI-written code, not as a compliance-grade security programme.
- Choosing a selection results in a full page refresh.
- Opens in a new window.