Product
What is VibeSafe? The AI security scanner built for vibe coding
You describe an app to Lovable, Bolt, Cursor, Replit or v0, and a few hours later it works. What you can't see is whether it's safe — whether your API keys shipped to the browser, whether any logged-in user can read everyone else's data, whether the login check is only on the button and not on the server. VibeSafe reads the code the AI wrote and tells you, in plain English, what a stranger could do with it and how to fix it.
Why vibe-coded apps need their own scanner
AI coding tools are optimised for one thing: code that runs. A demo that works is the success signal. Security doesn't show up in a demo, because a demo never asks "what happens if I request someone else's data?"
That produces a recognisable pattern of problems, and they're different from the ones traditional security tools were built to find:
- The builder didn't write the code. A founder can't review what they don't read, so a missing access check goes unnoticed until someone exploits it.
- The mistakes are structural, not exotic. A database table with no row-level security. A secret key in client code. An admin route with no login check on the server.
- Enterprise scanners assume a security engineer is reading the output. A report full of CWE numbers and CVSS scores isn't useful to someone shipping their first app.
We've measured this rather than just asserting it. In a study of 400 real public apps built with Lovable, Bolt and v0, 18.5% had committed their .env file — every key in one place — straight into the repository.
What VibeSafe checks for
The scanner prioritises the issues that actually cause breaches in AI-built apps:
Exposed secrets
Service-role keys, secret Stripe keys and database passwords in code that reaches the browser — without falsely flagging keys that are meant to be public.
Missing database rules
Supabase tables without row-level security, including tables protected for reading but not for updating or deleting.
Broken access control
Missing login checks, client-side-only authorisation, and routes that act on any ID you send them.
Injection
SQL injection, cross-site scripting, path traversal — and prompt injection, where user input reaches an AI model unchecked.
Risky packages
Dependencies with known vulnerabilities, and "hallucinated" packages the AI invented that attackers can register.
Flows that break
Payment and webhook code that only handles the happy path — no branch for a declined card or a duplicated webhook.
Every finding comes with three things: what the problem is, what an attacker could do with it, and exactly how to fix it. Findings are mapped to the OWASP Top 10 for anyone who needs that.
How you use it
VibeSafe meets you wherever you build:
| Where | How it works |
|---|---|
| Website | Paste code, or point it at a file on GitHub, at vibesafe.info. Results in about twenty seconds. |
| VS Code & Cursor | The VibeSafe – Security Scanner extension, on the VS Code Marketplace and Open VSX, scans the file you're working on without leaving the editor. |
| Claude, Cursor & MCP clients | The VibeSafe MCP server lets you ask your AI assistant to "scan this file with VibeSafe" mid-conversation. |
| GitHub | A GitHub Action scans changed files on every pull request, comments with the results, and can fail the check on critical issues. |
| Terminal | The vibesafe-scan CLI for scripts and pipelines. |
Beyond the code: checking the live app
Launch Check
Code can be correct and the app can still be broken. Launch Check opens your deployed app in a real browser and uses it the way a first-time visitor would — clicking through pages, filling forms — then reports dead links, console errors and failed requests with screenshots and a launch-readiness score. More on how it works.
Live website scanning and monitoring
On paid plans, VibeSafe also scans a deployed URL from the outside: missing security headers, exposed files like .env or .git/config, insecure cookies and misconfigured CORS. It tells a real exposure apart from a page that merely loads — a correctly locked admin sign-in screen is reported as passing, not as a problem. Continuous monitoring re-scans your sites every week and alerts you if the security score drops.
What VibeSafe is not
Honesty matters more in security than anywhere else, so plainly:
- It's not a replacement for a professional audit. If your app handles payments at scale, health records or other high-risk data, pay for a human security review as well.
- It doesn't catch everything. No automated scanner does. It catches the common, costly mistakes quickly — which is where most AI-built apps are actually exposed.
- It can't see your database settings from your code. It can tell you your app assumes row-level security is on; it can't confirm it is. That check is a few clicks in your Supabase dashboard.
Your code stays yours
VibeSafe analyses your code and discards it. We keep the findings, so your scan history works, but not the source. We never use your code to train anything.
What it costs
| Plan | Price | Includes |
|---|---|---|
| Free | $0 | 10 code scans a month, 1 Launch Check a month, GitHub file scanning, the VS Code & Cursor extension. No card required. |
| Pro | $29/month, or $264/year | Unlimited scans, live website scanning, the GitHub Action, monitoring for 5 sites. 15-day free trial, no card needed. |
| Team | $99/month, or $888/year | Everything in Pro for your whole team, monitoring for 25 sites. |
See what your AI-built app is hiding
Scan a file in about twenty seconds. Plain-English results, a fix for every issue.
Start a free scan →No signup to try · 10 free scans a month · Your code is never stored
Frequently asked questions
Is VibeSafe free?
Yes. A free account includes 10 code scans a month and one Launch Check a month, with no card required. Pro is $29 a month, with a 15-day free trial, and adds unlimited scans, live website scanning and continuous monitoring.
Do I need to know how to code?
No. VibeSafe is built for founders who built their app with AI and didn't write the code themselves. Every finding is explained in plain language, with what an attacker could do and how to fix it.
Which AI tools does it work with?
Any of them. It reads the code, not the tool, so apps from Lovable, Bolt, Cursor, Replit, v0, Windsurf, Claude Code and hand-written code all work.
Does VibeSafe store my code?
No. Code is analysed and discarded. VibeSafe keeps the findings so you can see your scan history, not the source code itself.
Does it replace a security audit?
No. It catches the most common risks in AI-built apps quickly and cheaply. For high-risk apps, a professional audit is still worth doing.
Related: