Live
Secret exposure
Find API keys, tokens, private keys, database URLs, webhook secrets, and test credentials before they leave your repo.
New security scanner for AI-built code
Scan the code your AI assistant just wrote.
VibeScan checks Cursor, Bolt, Lovable, and v0 projects for leaked secrets, broken auth, injection paths, and risky data exposure before you share a repo or deploy.
60s
target scan time
14+
risk families
0 CLI
setup required
Launch list openDesigned for vibe-coded apps, weekend builds, client handoffs, and pre-deploy checks.First 500 signups get early access
Coverage
Security review shaped around how AI code fails.
Most generated code looks reasonable at a glance. VibeScan focuses on the parts that tend to be dangerous when speed beats scrutiny: credentials, route ownership, data boundaries, and user-controlled input.
Live
Broken access control
Spot missing route guards, admin-only actions exposed to users, and endpoints that trust client-side identity.
Live
Injection paths
Trace risky interpolation through SQL, NoSQL, shell commands, redirects, SSRF calls, and prompt payloads.
Beta
Data leakage
Catch responses that send raw customer data, internal errors, environment values, or over-broad object fields.
Next
AI-change diffing
Compare assistant-generated changes against the previous version and flag newly introduced security drift.
Next
Merge protection
Run VibeScan in CI and block merges when a generated change introduces a critical or high-severity finding.
Workflow
A security desk for the last mile before launch.
Keep the speed of AI-assisted building, then run the checks that are easy to miss when the feature appears to work.
Connect
Paste a repo link or upload a ZIP
VibeScan builds a temporary project map, ignores dependency noise, and focuses on the files you actually own.
Analyze
Security rules meet AI context
The scanner follows routes, handlers, model access, and environment usage instead of reporting generic lint noise.
Decide
Ship with a ranked report
Every issue gets a severity, file path, reason, and practical next action so you can fix the dangerous parts first.
Why it matters
Working code can still be unsafe code.
AI coding tools optimize for getting the feature over the line. They do not know your threat model, your customer data boundaries, or the route-level rules that make a feature safe in production.
VibeScan is the security pass after the build pass. It gives you a focused report before a demo, client handoff, public repository share, or deploy.
7/10
test apps exposed a credential
9/10
had at least one auth gap
4/10
contained injection risk
Sample report
Scan output
CRITICALapi/payments/route.tsLive secret committed
HIGHapp/admin/users.tsxMissing ownership check
HIGHlib/search.tsUser input reaches query string
MEDIUMapi/export/route.tsPII returned without masking
Launch track
Built for public repos first, deeper automation next.
Public GitHub repository scans
Patch suggestions with before and after diffs
Shareable client-ready security reports
GitHub Action checks for every pull request
Early access
Get the scanner before the public launch.
Launch access before the public release
Scanner coverage notes as new rules ship
A founder-built feedback loop for the first users