VibeCheck: Ship it without the oops.

The AI wrote the code. Who checked it?

Vibe coding gets you to "it works on my machine" fast. The boss fight starts after you hit deploy.

🔑

Keys in the open

An API key committed "just for testing" is now public, and someone else is running up your bill.

🗄️

Databases with the door open

Missing row-level security means any visitor can read (or delete) every user's data.

📂

Files you never meant to publish

A .env or .git folder served from your live site, or a library with a known hole. You find out from an angry DM.

Three steps. Zero lectures.

STEP 01

Paste a link

Drop in a GitHub repo or your live site URL. That's the whole setup.

STEP 02

The agent scans

It scans your repo and makes safe, read-only checks against your live site for secrets, open databases and config gaps.

STEP 03

Get your fix list

A plain-English report lands in your inbox, ranked by severity, with copy-paste fixes.

What we check

leaked_secrets

API keys, tokens and credentials in your repo's code and in the JavaScript your site serves.

exposed_databases

Supabase tables readable with the public key (RLS off), open Firebase databases and listable storage buckets.

exposed_files

.env files committed to your repo, plus .env or .git files reachable on your live site.

vulnerable_deps

Packages in your lockfile with known security advisories (via osv-scanner), with the version to upgrade to.

session_cookies

basics

HTTPS (HSTS), Content-Security-Policy, X-Frame-Options and other security headers.

Here's what lands in your inbox

Sample report. Example data only, not from a real project.

vibecheck-report · example-app (EXAMPLE)

2 critical · 1 warning · 1 info

[CRITICAL] OpenAI key exposed in client bundle

src/lib/ai.ts:4 ships your secret key to every visitor's browser.

# Fix: move the call to a server route

// app/api/chat/route.ts
const key = process.env.OPENAI_API_KEY; // server only

[CRITICAL] Row-level security disabled on "profiles"

Anyone with your anon key can read every profile.

alter table profiles enable row level security;
create policy "own row" on profiles
  for select using (auth.uid() = id);

[WARN] Session cookie missing Secure / HttpOnly

Add the flags wherever you set the cookie: Secure; HttpOnly; SameSite=Lax

[INFO] Missing Content-Security-Policy header

Pick your difficulty

Not sure? See a sample $19 full report, no signup needed.

EASY MODE

Mini-scan

✓ Top-level scan of one repo or URL
✓ Critical issues flagged
✓ Emailed summary

Run free check

RECOMMENDED

NORMAL MODE

Full Report

$19 one-time

✓ Every check, every severity
✓ Copy-paste fixes for each issue
✓ Plain-English explanations
✓ One re-scan after you fix

Get full report

HARDCORE MODE

Always On

$9 /month

✓ Re-scan on every push
✓ Alerts when something new breaks
✓ Full reports included
✓ Cancel anytime

Go Always On

FAQ

Do I need to be a "real" developer?

Nope. Reports are written in plain English, and every fix is something you can paste straight into your code or your AI editor.

Which tools does it work with?

Anything that ends up as a GitHub repo or a live URL: Cursor, Replit, Lovable, Bolt, v0, Windsurf, or hand-written code.

Can you scan private repos?

Yes. Install the VibeCheck GitHub App, which gets read-only access to repo contents, and it re-scans on every push.

Do you store my code?

We only read what's needed to run the scan, and we don't keep your source after the report goes out.

Is this a replacement for a security audit?

No. It catches the common, costly mistakes fast and cheap. If you handle payments or sensitive data at scale, get a professional audit too.

Can I cancel Always On?

Anytime, in one click. No retention boss fight.

You vibed it.
Now check it before you ship it.