vibecheck
built for people who ship with AI
vibecheck

You vibe-coded it fast.
Let's check what got skipped.

Paste your live URL for an instant header and TLS check — no account. Connect GitHub to scan the source code: secrets, unauthenticated routes, SQL injection, and more.

No account needed — checks live headers, TLS, CORS, and cookie flags

built for developers shipping with

CursorLovableBoltv0ReplitWindsurfCursorLovableBoltv0ReplitWindsurf

what actually runs when you scan

gitleaks

secrets

semgrep

OWASP rules

njsscan

headers, auth

vibecheck

12 custom checks

Claude only sees the normalized results from these tools — explaining and prioritizing, never guessing at vulnerabilities from scratch.

Also available as a VS Code extension — scan before you deploy.

Built specifically because vibe-coded apps have a predictable set of security mistakes — disabled RLS, missing auth on routes, secrets in source — that generic scanners miss. vibecheck runs the tools that actually catch these.

what we check

SECRETS & EXPOSURE

  • ·Hardcoded API keys & tokens
  • ·NEXT_PUBLIC_ secret exposure
  • ·JWT weak / hardcoded secrets
  • ·Verbose error leaks
  • ·Dockerfile secrets in ENV/ARG
  • ·Secrets interpolated into AI prompts

ACCESS CONTROL

  • ·Unauthenticated API routes
  • ·Supabase RLS disabled
  • ·Mass assignment
  • ·CORS misconfiguration
  • ·IDOR — missing ownership checks
  • ·GraphQL introspection in production

INJECTION

  • ·SQL injection
  • ·NoSQL injection (MongoDB)
  • ·Command injection
  • ·Server-side template injection
  • ·XSS (stored, reflected, DOM)
  • ·CRLF injection in response headers
  • ·CSV formula injection
  • ·Prototype pollution

SERVER-SIDE

  • ·SSRF + cloud metadata
  • ·Path traversal
  • ·Open redirect
  • ·Insecure file upload
  • ·Host header injection
  • ·TLS certificate verification disabled

AUTH & SESSIONS

  • ·JWT weak / hardcoded secrets
  • ·Timing-unsafe token comparison
  • ·Auth endpoints missing rate limiting
  • ·OAuth state validation
  • ·Webhook signature verification
  • ·Insecure password hashing (MD5/SHA-1)

NODE / FRAMEWORK

  • ·Missing security headers
  • ·ReDoS — user input to RegExp
  • ·Dangerous eval / new Function
  • ·Dependency CVEs (npm audit)
  • ·Express trust proxy misconfiguration
  • ·GitHub Actions script injection

AI / LLM APPS

  • ·LLM output passed to eval/exec/SQL
  • ·Secrets in AI prompt strings
  • ·Prompt injection sinks
  • ·Missing AI output validation

what a finding looks like

CRITICALRow level security disabled on table "users"

database/migrations/001_initial_schema.sql · line 12

Any authenticated user can read or write other users' rows directly through the API, even though the UI only shows their own data.

view explanation & fix →

Supabase's row level security is disabled on this table. Any user with a valid JWT can query or mutate any row — not just their own. Your frontend may filter correctly, but a direct API or curl call bypasses it entirely. This is the most common critical finding in AI-generated Supabase projects.

ALTER TABLE users ENABLE ROW LEVEL SECURITY;

CREATE POLICY "users_own_rows" ON users
  FOR ALL USING (auth.uid() = id);

"I run this against my own five live products before every deploy. It's the check I wished existed when I shipped the first one."

— the developer behind vibecheck

Pricing that fits a portfolio, not a payroll

Free

£0

  • 2 repos
  • unlimited scans
  • counts and titles only

Solo

£12/mo

  • up to 5 repos
  • full fixes and explanations
  • scan history and diffing

Indie stack

£27/mo

  • unlimited repos
  • auto-PR for safe fixes
  • priority queue

what builders say

“love that it bundles gitleaks, semgrep, and the supabase RLS checks together instead of making you wire them up separately, the triage output from claude actually reads like a human reviewed it”

Esila· ProductHunt

“Plugged in a repo and the Supabase RLS flag caught a table I had completely forgotten to lock down. The Claude triage is actually useful here, not just a wrapper, since it explains the blast radius in plain language.”

Serhat· ProductHunt

Common questions

What is vibecheck?
vibecheck is a security scanner for GitHub repositories built by developers who use AI coding assistants. It runs four real static analysis tools — Gitleaks, Semgrep, njsscan, and custom checks — against your codebase, then uses Claude AI to explain the findings in plain language and suggest fixes.
What is "vibe coding" and why is it a security risk?
Vibe coding refers to building software primarily through AI-assisted generation — prompting tools like Cursor, Claude Code, or GitHub Copilot to write most of the application code. The output ships fast, but common security patterns (authentication checks, RLS on database tables, input sanitization) are frequently omitted because AI models optimise for functional code, not secure code by default.
What security scanners does vibecheck run?
vibecheck runs four scanners in sequence: Gitleaks for exposed secrets and API keys; Semgrep for OWASP Top 10 code patterns including SQL injection, XSS, and path traversal; njsscan for Node.js-specific patterns like missing security headers and eval usage; and 33 custom checks written specifically for AI-generated app patterns — Supabase RLS gaps, unauthenticated routes, IDOR, NoSQL injection, ReDoS, SSTI, Host header injection, CRLF injection, timing-unsafe token comparison, GraphQL introspection, CSV formula injection, missing .env in .gitignore, and more.
How is vibecheck different from asking an AI to review my code?
Asking an AI chatbot to review code is non-deterministic and context-limited — it guesses based on what it can see in one prompt window. vibecheck runs deterministic static analysis tools against your full codebase. Claude only appears at the end to translate and prioritize confirmed findings, never to detect vulnerabilities from scratch.
Is my code stored or shared?
No. vibecheck performs a shallow clone of your repository in an isolated worker process, runs the scanners, then discards the clone. Your GitHub token is AES-256-GCM encrypted at rest and only decrypted inside the worker immediately before cloning. Only the normalized findings (file paths, line numbers, rule names) are stored in the database.
How much does vibecheck cost?
The Free plan supports 2 repositories with unlimited scans and shows severity counts and finding titles. Solo (£12/month) supports up to 5 repos and includes full explanations and suggested fixes. Indie Stack (£27/month) is unlimited repos with a priority scan queue. No per-seat pricing — you pay once for your whole portfolio.