What is vibecheck?+
vibecheck is a security scanner for GitHub repositories built by developers who use AI coding assistants. It runs four real static analysis tools — Gitleaks, Semgrep, njsscan, and custom checks — against your codebase, then uses Claude AI to explain the findings in plain language and suggest fixes.
What is "vibe coding" and why is it a security risk?+
Vibe coding refers to building software primarily through AI-assisted generation — prompting tools like Cursor, Claude Code, or GitHub Copilot to write most of the application code. The output ships fast, but common security patterns (authentication checks, RLS on database tables, input sanitization) are frequently omitted because AI models optimise for functional code, not secure code by default.
What security scanners does vibecheck run?+
vibecheck runs four scanners in sequence: Gitleaks for exposed secrets and API keys; Semgrep for OWASP Top 10 code patterns including SQL injection, XSS, and path traversal; njsscan for Node.js-specific patterns like missing security headers and eval usage; and 50 custom checks written specifically for AI-generated app patterns — covering secrets exposure, access control, injection attacks, supply chain (malicious postinstall scripts, obfuscated dependencies, binary executables, GitHub Actions permission escalation), AI agent prompt injection (detecting "ignore previous instructions" and covert overrides in CLAUDE.md, README, AGENTS.md, and MCP configs), and repository trust (committed git hooks with shell execution, dangerous git config overrides, devcontainer lifecycle injection, curl-pipe-to-shell setup scripts, and submodule URL poisoning).
How is vibecheck different from asking an AI to review my code?+
Asking an AI chatbot to review code is non-deterministic and context-limited — it guesses based on what it can see in one prompt window. vibecheck runs deterministic static analysis tools against your full codebase. Claude only appears at the end to translate and prioritize confirmed findings, never to detect vulnerabilities from scratch.
Is my code stored or shared?+
No. vibecheck performs a shallow clone of your repository in an isolated worker process, runs the scanners, then discards the clone. Your GitHub token is AES-256-GCM encrypted at rest and only decrypted inside the worker immediately before cloning. Only the normalized findings (file paths, line numbers, rule names) are stored in the database.
How much does vibecheck cost?+
The Free plan supports 2 repositories with unlimited scans and shows severity counts and finding titles. Solo (£12/month) supports up to 5 repos and includes full explanations and suggested fixes. Indie Stack (£27/month) is unlimited repos with a priority scan queue. No per-seat pricing — you pay once for your whole portfolio.
