Replay pentests your web app on every QA pass now: injection flaws, broken access control, IDOR, the stuff AI-generated code tends to miss. Findings come back as full bug reports, evidence and suggested fix included. Schedule it daily or weekly and skip the "remember to test" step. You wake up to a queue of bugs already triaged. Same projects also test against dev, staging, prod, and localhost, so you're not maintaining separate QA setups per environment.
AI coding tools are good at making things that work. Security intuition is different, built from years of pentesting experience, and it's not something these models reliably apply yet. Agents write API endpoints that return the right data, not endpoints that check who's asking for it. That gap is where IDOR, broken access control, and injection flaws come from, and we kept seeing it in apps our own QA agents were testing.
So we built Security Scan into Replay QA. It runs a real pentesting pass against your live app, actual attack payloads, and turns findings into a report: the vulnerability, how it was triggered, what an attacker could do, and what to fix.
One catch: since it sends live attack traffic, the first run requires ownership verification. Non-negotiable, we're not running exploits against apps people don't control. Runs on the same schedule as the rest of Replay QA (every push, every PR, or a fixed cadence), so it's not something you have to remember to kick off.
Great launch, much needed.. good wishes for your success.. on lighter note, imagine the flags being raised, if your system was named "AI Hacker for your AI apps"
Hey Kevin, huge congrats on the launch. I love the addition of the auto verification step for live attack traffic such a clever way to ensure everything stays responsible. I can not wait to test this out on a few prs and see what it picks up.
The deterministic runtime recordings sound really useful. Being able to replay exactly what happened when a bug appears could make debugging much easier.
About Replay QA Security Scan on Product Hunt
“Automated Penetration Testing for AI-Built Apps”
Replay QA Security Scan launched on Product Hunt on September 8th, 2026 and earned 114 upvotes and 5 comments, placing #11 on the daily leaderboard. Replay pentests your web app on every QA pass now: injection flaws, broken access control, IDOR, the stuff AI-generated code tends to miss. Findings come back as full bug reports, evidence and suggested fix included. Schedule it daily or weekly and skip the "remember to test" step. You wake up to a queue of bugs already triaged. Same projects also test against dev, staging, prod, and localhost, so you're not maintaining separate QA setups per environment.
Replay QA Security Scan was featured in Developer Tools (519.6k followers) and Security (2.9k followers) on Product Hunt. Together, these topics include over 90.1k products, making this a competitive space to launch in.
Who hunted Replay QA Security Scan?
Replay QA Security Scan was hunted by fmerian. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Reviews
Replay QA Security Scan has received 1 review on Product Hunt with an average rating of 4.00/5. Read all reviews on Product Hunt.
Want to see how Replay QA Security Scan stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
fmerian
Hey Product Hunt,
Kevin here from @Replay .
AI coding tools are good at making things that work. Security intuition is different, built from years of pentesting experience, and it's not something these models reliably apply yet. Agents write API endpoints that return the right data, not endpoints that check who's asking for it. That gap is where IDOR, broken access control, and injection flaws come from, and we kept seeing it in apps our own QA agents were testing.
So we built Security Scan into Replay QA. It runs a real pentesting pass against your live app, actual attack payloads, and turns findings into a report: the vulnerability, how it was triggered, what an attacker could do, and what to fix.
One catch: since it sends live attack traffic, the first run requires ownership verification. Non-negotiable, we're not running exploits against apps people don't control. Runs on the same schedule as the rest of Replay QA (every push, every PR, or a fixed cadence), so it's not something you have to remember to kick off.
Try it here: qa.replay.io
Happy to answer questions all day and curious what you find if you point it at something you've shipped.