Is your vibe-coded app
safe to ship?
Paste a public GitHub repo. Get a free preliminary score out of 100 in under a minute: leaked keys, open database rules, unprotected API routes and launch basics.
No signup, no email. Public repos only. We read the code; we never install or run it.
01 How it works
Paste your repo
Any public GitHub URL. No signup, no email, no write access.
Get a preliminary score
Surface checks in under a minute. It’s a ceiling: the dependency check in the full report can only lower it.
Unlock the fixes
$19 Full Report: every finding, a dependency audit, and a copy-paste AI prompt to fix each one.
02 A real report, anonymized
From a real open-source Next.js + Supabase storefront we scanned. Names removed; findings unchanged.
13 npm packages with known vulnerabilities
Why it matters: Includes a critical Next.js advisory (image optimization cache-key confusion).
→ Run npm audit fix, then bump Next.js to the latest patch release and re-test.
Supabase tables without Row Level Security (2)
Why it matters: Anyone holding your public anon key (it ships in your frontend) can read or change these tables.
→ alter table <name> enable row level security; then add policies like using (auth.uid() = user_id).
Supabase policies that allow everyone — using (true)
Why it matters: A true policy on write actions means any visitor can insert/update/delete.
→ Replace true with a real condition, especially on insert/update/delete policies.
No lockfile committed
Why it matters: Without a lockfile, every fresh install can pull different package versions, so your app may break on deploy.
→ Run npm install and commit the generated package-lock.json.
API routes with no visible auth check (8 of 12)
Why it matters: Routes like /api/checkout and /api/upload can be called directly, bypassing your UI.
→ Get the current user at the top of each handler and return 401 if missing.
03 Pricing
Free vibe score
- Public GitHub repos
- Preliminary score (surface checks, no dependency check) and issue counts by severity
- On screen in under a minute, no email needed
- Shareable score card
Full Report
- One public GitHub repo
- Every finding with a plain-English fix
- A copy-paste “Fix it with AI” prompt for each finding (Cursor, Lovable, Bolt, Claude)
- Free re-scans of the same repo for 30 days, with before/after score
- “VibeCheck Verified” README badge if you score 80+
- HTML report emailed to you
- Full refund if the scan fails
Public repos only; private repos aren't supported yet. Reports are produced by an automated queue and emailed, usually within minutes, not shown instantly. Refund policy.
Auto-Fix
- Agents open a pull request with the fixes
- Private repos
- Re-scan on every push
04 FAQ
What is a “vibe-coded” app?
An app built mostly by prompting AI tools (Cursor, Lovable, Bolt, v0, Claude, etc.). They ship fast, but often with open database tables, leaked keys and unprotected API routes.
What do you check?
Leaked secrets and API keys, Supabase tables without RLS or with wide-open policies, API routes without auth checks, known-vulnerable dependencies, type errors and other breakage risks, plus launch-readiness basics.
Do you need access to my code?
The free scan works on public GitHub repos: you paste the URL, we read the code. No login and no write access. Private repos come later via a GitHub app with read-only scope.
How fast is the free score?
Usually under a minute, right on the page, with no email needed. It’s a preliminary score from surface checks only: it doesn’t check your packages for known vulnerabilities, so treat it as a ceiling. The $19 Full Report includes the dependency check, which can only lower the score, sometimes by a lot. A high free score doesn’t mean you’re ready to launch.
Will you fix the issues for me?
Every finding comes with a plain-English fix and a ready-to-paste prompt for your AI tool. A paid Auto-Fix tier, where agents open a pull request with the fixes, is coming soon.
What are the “Fix it with AI” prompts?
Each finding in the Full Report comes with a ready-to-paste prompt for Cursor, Lovable, Bolt, v0 or Claude. It names the file and line, explains the problem in plain language and asks the AI to fix it safely. AI tools can still make mistakes, so review the change before you ship.
Can I re-scan after fixing things?
Yes. Your report email includes a private re-scan link. For 30 days after purchase you can re-scan the same repo for free (up to once an hour, 10 re-scans in total) and get your before/after score by email.
What is the VibeCheck Verified badge?
If a paid scan or re-scan scores 80 or more, we send you an SVG badge and README snippet showing the score and scan date. It doesn’t show your findings. It reflects one automated scan at a point in time, not a security guarantee.
Can you scan private repos?
Not yet. The $19 Full Report works on public GitHub repos only. Please don’t buy a report for a private repo; if you do by mistake, the scan will fail and you’ll be refunded.
Is a good score a security guarantee?
No. VibeCheck catches common, high-impact mistakes automatically. It’s not a replacement for a professional audit on apps handling sensitive data.
Ship it. But check the vibes first.
Get notified when Auto-Fix and private repos launch.