Find the security holes vibe-coding left behind, before your users do.
Paste a GitHub repo or upload your code. VibeGuard runs static analysis tuned for the mistakes AI coding tools actually make — leaked keys, missing RLS, client-only auth — and hands you prioritized fixes.
No credit card. Your repository is scanned in memory and never kept.
How it works
From repo to prioritized fixes in under a minute.
Paste your repo
Drop in a GitHub URL or upload a zip of your codebase. Connect GitHub once and private repositories work too.
We scan it
A static analysis engine tuned for AI-generated code checks secrets, auth, injections, XSS, CORS, RLS and known-vulnerable dependencies.
Get prioritized fixes
Every finding comes with severity, exact file and line, a plain-English explanation and a copy-paste fix snippet.
What we detect
Ten checks aimed at the failure modes of AI-generated code.
Hardcoded secrets & API keys
Provider key formats (AWS, Stripe, OpenAI, GitHub…) plus entropy analysis for everything else.
Committed .env files
Environment files in the repo and client-exposed secret variables (NEXT_PUBLIC_…).
Client-side-only auth
Auth checks that live only in frontend JS — localStorage tokens, client role checks, hardcoded passwords.
Missing input validation
API handlers that pipe raw request bodies into your data layer with no validation.
SQL injection patterns
String-concatenated and template-interpolated queries across JS/TS, Python and PHP.
XSS-prone rendering
dangerouslySetInnerHTML, innerHTML, v-html and unescaped template output without sanitization.
Misconfigured CORS
Wildcard origins, reflected origins and credentialed wildcard combos.
Supabase RLS gaps
Tables without Row Level Security and policies that allow everyone to write everything.
Vulnerable dependencies
package.json, requirements.txt, composer.json, go.mod and Cargo.toml cross-checked against the OSV.dev vulnerability database.
Dangerous dynamic execution
eval, new Function, shell commands built from user input, unsafe deserialization.
What a finding looks like
Real reports look exactly like this — severity, location, risk, fix.
OpenAI API key found hardcoded in source (sk-p****************Xk2a). Anyone with repo access can use this credential and bill your account.
Suggested fix
- const openai = new OpenAI({ apiKey: "sk-proj-8fK2..." });
+ const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
# .env.local (git-ignored)
+ OPENAI_API_KEY=sk-proj-...Pricing
Free to try. Pro when you ship.
During the beta, every Pro feature is free for everyone.
Pro
$12/month
$9/mo billed annually
- Unlimited scans
- Full detailed findings & fixes
- PDF export
- Scan history
- GitHub repo direct connect
Payments launch after beta — enjoy Pro free for now.
Frequently asked questions
Is my code safe and private?+
Yes. Your repository is downloaded into memory, scanned, and discarded — we never keep your source files. What is saved to your account is the findings: file paths, line numbers, explanations, and a few lines of the surrounding code so the report can show you what it means. Values inside secret findings are masked before they are stored. Everything is protected by row-level security, so only you can read it.
Which languages and frameworks are supported?+
JavaScript/TypeScript (Next.js, React, Vue, Svelte, Express) get the deepest coverage, plus Python, PHP and SQL migrations. Dependency checks cover npm, PyPI, Packagist, Go and crates.io.
Will there be false positives?+
Static analysis always has some. We tune rules for precision (placeholder detection, entropy thresholds, sanitizer awareness), and every finding shows the exact line so you can verify in seconds.
Can I scan private repositories?+
Yes. Connect your GitHub account on the dashboard and VibeGuard can scan your private repositories directly. You can also upload a zip of any codebase without connecting anything.
Does VibeGuard fix issues automatically?+
Every finding includes a copy-paste fix snippet. Automatic pull-request fixes are on the roadmap.
Why focus on AI-generated code?+
AI coding tools make characteristic mistakes: keys pasted into source, auth done only client-side, RLS forgotten entirely. Generic scanners miss the pattern; VibeGuard is tuned for exactly these failure modes.