VibeCheck Hub

Security built for AI‑generated code.

Scan your repo for leaked secrets, broken auth, vulnerable dependencies, and other risks your AI may have missed.

Get started freeHow it works

8 free scans a month · Read-only GitHub access · No card required

How it works

Connect, scan, fix.

Scan your first repo free
vibecheckhub.ai/projects/my-first-app 01 / 04
Scan #134 in progress

Reading through your project…

  • Starting your scan…

Usually takes a couple of minutes. You can leave — we'll keep going.

Read

Works with the tools you already use

Cursor Claude CodeCodex GitHub or your own tool MCP

Why now

The mistakes AI makes silently.

Your AI ships code faster than anyone can read it. The mistakes ship just as fast.

Most apps

we've scanned so far turned up at least one issue nobody knew was there.

An afternoon of vibe coding~214 files

One scan of all of it~3 minutes

One pasted prompt

is usually all it takes to fix what we find. Rescan to prove it's gone.

Sample findings · hover to pause
.envSample
1DATABASE_URL=postgres://localhost/app
2OPENAI_API_KEY=sk-proj-4f9xQ2…Critical
3PORT=3000

OpenAI API key committed in .env Secrets

The file is committed, so anyone who can see the repo can spend against your OpenAI account.

Fix prompt ready →

src/routes/admin.jsSample
1router.delete('/users/:id',Critical
2 async (req, res) => {
3 await users.remove(id);

Admin routes missing authentication Security

No check on who is asking. A stranger with the URL could edit or delete accounts.

Fix prompt ready →

src/auth/reset.jsSample
1const token = randomBytes(32);
2await tokens.save({ user, token });High
3sendResetEmail(user, token);

Password reset tokens never expire Security

A reset link from months ago still works. Anyone who finds an old email can take over that account.

Fix prompt ready →

package.jsonSample
1"dependencies": {
2 "jsonwebtoken": "8.5.1",High
3}

Vulnerable dependency: jsonwebtoken 8.5.1 Dependencies

In some configurations it lets attackers forge tokens, and tokens are your whole login system.

Fix prompt ready →

src/server.jsSample
1app.use(cors({
2 origin: true, credentials: true,Medium
3}));

CORS allows requests from any origin Security

Any site a signed-in user visits can call your API with their session cookie and read the responses.

Fix prompt ready →

src/lib/logger.jsSample
1function log(req) {
2 console.log('payload', req.body);Low
3}

Console logging left in production code Code quality

Payloads can carry user data, and logs travel further than databases: backups, log tools, teammates.

Fix prompt ready →

Browse a full sample report

Every finding

Three questions, always answered.

No wall of 400 warnings. The issues that actually matter, worst first, in words you already know.

What's wrong

The exact file and line, shown in your code. Not a rule ID, the actual mistake.

Why it matters

What it could actually cost you: your account, your data, your users. No jargon, no acronyms.

How to fix it

A prompt written for the AI tool you already use. Paste it, rescan, watch it go green.

Know where you stand

One score.
Eight areas. No mystery.

A single project health score shows what you've cleaned up and what's still open, so you ship knowing what you checked.

Project health82/100

Almost ready to ship. 1 fix to go.

SecretsAll clear
Security1 to fix
DependenciesAll clear
ArchitectureAll clear
Code qualityAll clear
PerformanceAll clear
AccessibilityAll clear
CostAll clear

Pricing

Start free. Your worst problems, fully explained.

Free

$0

8 scans a month on 1 repo. Your top 3 Critical and top 3 High issues, explained in full.

Scan your first repo
Most popularBuilder

$29/mo

5 repos, 500 scans a month. Every issue, every severity. Fix from your editor.

Get Builder
See full pricing

Free to start

Ship it with confidence.

Your first scan takes just a few minutes. Your first fix might too.

Get started See how it works
  • No credit card
  • Read-only access
  • Cancel anytime

© 2026 VibeCheck Hub