Your AI generateda vulnerability,not a feature.
VibeCheck is cybersecurity software built for the vibe coder generation. Paste your code. Get an exploit-path report with specific fixes. Large scans can take a few minutes.
- · 5-layer security coverage matrix
- · CRITICAL / HIGH / MEDIUM / LOW severities
- · Exploit path, written like a threat model
- · Clear fix recommendations
- · File results stay in your browser until you leave the page
The tools that ship our code doubled in a year.
The tools that check our code did not.
Three moves. One report.
Paste or upload up to 10 files, or scan one public or connected private GitHub repository with a repository package.
VibeScan uses a proprietary detection prompt to check five layers of AI-specific failure modes that traditional scanners often skip.
See severity, evidence, exploit paths, and fix recommendations. File reports stay in your browser; encrypted repository reports expire after 24 hours.
An AI-generated checkout endpoint.
Three real vulnerabilities.
142 lines of the kind of code vibe-coding tools ship every day. Findings, severity triage, coverage matrix, exploit paths, and fix recommendations from the VibeScan Engine.
// app/api/checkout/route.tsimport { stripe } from '@/lib/stripe';import { supabase } from '@/lib/supabase'; export async function POST(req: Request) { const { priceId, userId } = await req.json(); const { data: user } = await supabase .from('users') .select('*') .eq('id', userId) .single(); const session = await stripe.checkout.sessions.create({ line_items: [{ price: priceId, quantity: 1 }], mode: 'subscription', customer_email: user.email, success_url: `${req.headers.get('referer')}?ok=true`, metadata: { userId }, }); return Response.json({ url: session.url });}
userId is taken directly from the request body, never compared to the authenticated session user.
const { priceId, userId } = await req.json();
const { data: user } = await supabase
.from('users').select('*').eq('id', userId).single();1. Attacker signs up. 2. Captures any other user's id. 3. POSTs { priceId, userId: victimId }. The victim's email is sent to Stripe and the victim's card is charged.
Drop userId from body. Read from session: const { data: { user } } = await supabase.auth.getUser();
Legacy scanners were built for human-written code.
They miss what AI ships.
Review before you ship.
Practical security checklists for founders and developers building with AI. Use them before launch, then run a scan when you want a second set of eyes on the code.
Vibe coding security
What an AI code security scanner should prove
Learn what source scanning can find, how to prepare files, how to read a report, and where live testing is still required.
READ THE SCANNER GUIDE →AI-generated code
Security checklist before you ship
A practical review of secrets, authorization, validation, payments, abuse controls, and release readiness.
READ THE CHECKLIST →Cursor workflow
Review Cursor-generated code before launch
A focused review workflow for generated routes, data access, integrations, and deployment configuration.
READ THE CURSOR GUIDE →Lovable workflow
Review a Lovable app before launch
A focused checklist for authentication, Supabase access, secrets, server functions, payments, uploads, and production testing.
READ THE LOVABLE GUIDE →Choose the coverage.
Keep the clear report.
One-time cybersecurity scans with exact file and source limits. Repository files are not saved; encrypted reports, including evidence excerpts, expire after 24 hours.
Focused coverage for the files you are actively shipping.
- +Paste code or upload up to 10 files
- +200,000 source characters
- +Immediate browser-only report
- +All 5 security layers
- +Exploit paths and specific fixes
Batched security analysis from one immutable GitHub commit.
- +Public or private GitHub repository
- +Up to 100 source files
- +1,000,000 source characters
- +All 5 security layers
- +Exploit paths and specific fixes
Batched security analysis from one immutable GitHub commit.
- +Public or private GitHub repository
- +Up to 500 source files
- +5,000,000 source characters
- +All 5 security layers
- +Exploit paths and specific fixes
Every package is one scan, one exact payment, and no subscription. Higher-tier credits cannot be substituted for another package.
Scan before
they do.
Repository scanning is available now. Join the product list for saved reports, continuous scanning, and other upcoming releases.