VibeSafe

You built an app with AI. Is it safe to ship?

53% of AI-generated code has security vulnerabilities. 4,000+ accessibility lawsuits filed in 2024 alone. Your AI doesn't check for any of this. VibeSafe does.

Scan your app now →

Paste your GitHub URL. Get your safety score in 30 seconds. We'll tell you exactly what's wrong and give you a prompt to paste into your AI to fix everything.

No signup. No install. Free.

---

How it works

1. Paste your GitHub repo URL
2. 30 seconds later — safety score + every issue found
3. Copy the AI Fix Prompt → paste into Cursor, Claude, or ChatGPT
4. Your AI fixes everything. You ship safe.

That's it. You don't need to understand the issues. Your AI does.

---

What it catches

What AI gets wrong	Why it matters
Hardcoded API keys in your code	Anyone can find them and use your paid services
SQL injection, XSS, command injection	Attackers can steal your users' data
<img> without alt, inputs without labels	64% of ADA lawsuits target small businesses
Supabase without Row Level Security	All your database rows are public by default
Flask/Django debug mode in production	Gives attackers a code execution backdoor

We scanned 10 open-source apps built with Lovable, Bolt, and Cursor. 8 out of 10 had issues.

---

What happens if you don't scan

These are real incidents from vibe-coded apps:

• Moltbook — 1.5 million auth tokens + 35,000 emails exposed
• Lovable app — 18,000 users' data leaked through misconfigured Supabase
• Escape research — 5,600 vibe-coded apps → 2,000+ vulnerabilities, 400+ exposed secrets

---

Want this on every PR? (optional)

If you use GitHub for your code, you can add VibeSafe as an automatic check.

Copy this file to .github/workflows/vibesafe-scan.yml:

name: VibeSafe Security Scan

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  vibesafe:
    name: Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v4

      - name: Run VibeSafe scan
        uses: vibesafeio/vibesafe-action@v0
        with:
          domain: auto

PR comments are posted automatically. No extra configuration needed.

---

How it works

PR opened
  │
  ▼
┌─────────────────────────────────────────────┐
│  1. Stack Detection                         │
│     Reads imports, configs, package.json    │
│     → Flask? Express? Next.js? Supabase?    │
└──────────────────┬──────────────────────────┘
                   ▼
┌─────────────────────────────────────────────┐
│  2. Rule Selection                          │
│     Domain (ecommerce/fintech/platform)     │
│     + Language + Framework → rule set       │
└──────────────────┬──────────────────────────┘
                   ▼
┌─────────────────────────────────────────────┐
│  3. Scan (parallel)                         │
│                                             │
│  SAST ──────── SQL injection, XSS, eval()  │
│  Secrets ───── API keys, tokens, JWTs       │
│  SCA ───────── Known CVEs in dependencies   │
│  Config ────── Supabase RLS, Firebase rules │
│  Accessibility  <img> no alt, input no label│
└──────────────────┬──────────────────────────┘
                   ▼
┌─────────────────────────────────────────────┐
│  4. Score (0-100)                           │
│     Weighted by domain + severity           │
│     Framework conflict filtering            │
│     → Grade A/B/C/D/F + Certified badge     │
└──────────────────┬──────────────────────────┘
                   ▼
┌─────────────────────────────────────────────┐
│  5. PR Comment                              │
│     File:line + code + fix + AI Fix Prompt  │
│     Fail gate → exit 1 if critical found    │
└─────────────────────────────────────────────┘

What It Scans

Layer	What AI gets wrong	VibeSafe catches
Code	eval(), f-string SQL, shell=True, XSS	SAST — OWASP Top 10 + custom rules
Secrets	Hardcoded API keys, tokens in frontend	15 secret patterns
Config	Supabase without RLS, Firebase test mode	Config scanner
Dependencies	Known CVEs	SCA — pip-audit + npm audit
Accessibility	<img> without alt, <input> without label	WCAG 2.1 Level A rules

Domain Options

domain: auto        # Auto-detect from code analysis (default)
domain: ecommerce   # Payments/orders — PCI DSS rules
domain: fintech     # Banking/transfers — AML rules
domain: healthcare  # Patient data — HIPAA rules
domain: platform    # SaaS/multi-tenant — JWT, RBAC
domain: game        # Game servers — WebSocket, client tampering
domain: education   # Student data — FERPA, COPPA

---

Diff-Only Scanning

VibeSafe automatically scans only new code introduced by the PR — not the entire repo. This means:

• Faster scans (seconds, not minutes)
• No noise from pre-existing issues
• Only shows vulnerabilities YOU introduced
• Works automatically when triggered by pull_request events

This is the same --baseline-commit approach used by Semgrep's paid tier, but free.

---

Custom Rules

Add your own Semgrep rules on top of VibeSafe's defaults:

- uses: vibesafeio/vibesafe-action@v0
  with:
    domain: auto
    custom-rules: "./my-rules.yml,p/react,https://example.com/team-rules.yml"

Share rules with the community — a YAML file is all it takes. Examples:

• p/react — React-specific rules from Semgrep registry
• ./security/fintech-rules.yml — your team's custom rules
• URL to a shared ruleset

---

Dynamic Badge for Your README

Add an auto-updating VibeSafe badge to your README. Add this step after VibeSafe scan:

- name: Update VibeSafe badge
  if: github.ref == 'refs/heads/main'
  uses: schneegans/[email protected]
  with:
    auth: ${{ secrets.GIST_SECRET }}
    gistID: YOUR_GIST_ID
    filename: vibesafe-badge.json
    label: VibeSafe
    message: "${{ steps.vibesafe.outputs.score }}/100 ${{ steps.vibesafe.outputs.grade }}"
    color: ${{ steps.vibesafe.outputs.grade == 'A' && 'brightgreen' || steps.vibesafe.outputs.grade == 'B' && 'green' || steps.vibesafe.outputs.grade == 'C' && 'yellow' || 'red' }}

Then in your README:

![VibeSafe](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/YOUR_USER/YOUR_GIST_ID/raw/vibesafe-badge.json)

---

Scoring

Grade	Score	Meaning
🟢 A + ✅ Certified	85 – 100	No Critical or High findings
🟢 A	85 – 100	Good
🟡 B	70 – 84	Minor vulnerabilities
🟠 C	50 – 69	Multiple medium findings
🔴 D / F	0 – 49	Critical or High findings present

✅ Certified badge is issued when Critical = 0, High = 0, and score >= 85.

---

Outputs

Use scan results in downstream steps:

- run: echo "Score: ${{ steps.vibesafe.outputs.score }}"

Output	Description	Example
score	Security score (0-100)	82
grade	Grade (A-F)	B
domain	Detected domain	fintech
certified	Certified badge issued	true
critical	Critical count	0
high	High count	2
medium	Medium count	5
low	Low count	3
total	Total findings	10

---

Merge Blocking

By default, VibeSafe fails the check (exit 1) when critical vulnerabilities are found. GitHub branch protection will block the merge automatically.

- uses: vibesafeio/vibesafe-action@v0
  with:
    domain: auto
    fail-on: high     # Block on high or critical (default: critical)
    # fail-on: none   # Never block, comment only

fail-on	Blocks merge when
critical (default)	Critical >= 1
high	High >= 1 or Critical >= 1
medium	Medium >= 1 or above
low	Any finding
none	Never (comment only)

To enable: Settings → Branches → Branch protection rules → Require status checks → add Security Scan

---

Pre-commit Hook (optional)

Catch secrets locally before they enter git history:

cp tools/pre_commit_hook.py .git/hooks/pre-commit
chmod +x .git/hooks/pre-commit

Blocks commits containing hardcoded API keys or tokens. If Semgrep is installed, SAST runs too.

Force commit: git commit --no-verify

---

MCP Server — Real-time IDE Security (optional)

Detect secrets in real-time while coding in Claude Code or Cursor.

Claude Code:

claude mcp add vibesafe -- python /path/to/vibesafe/tools/mcp_server.py

Cursor (.cursor/mcp.json):

{
  "mcpServers": {
    "vibesafe": {
      "command": "python",
      "args": ["/path/to/vibesafe/tools/mcp_server.py"]
    }
  }
}

Tools: vibesafe_check_secret (text scan) and vibesafe_scan_file (file scan with fix suggestions).

---

FAQ

Is my code safe with you? The web scanner clones your repo, scans it, and deletes it immediately. Nothing is stored. The GitHub Action runs entirely inside GitHub's own servers.

Does it cost money? No. Free forever. Open source.

Do I need to know coding? No. Paste your GitHub URL, get results, copy the fix prompt into your AI. That's it.

What languages does it support? JavaScript, TypeScript, Python, Java, Go, Ruby, PHP, Kotlin, and more.

---

Scan your app now →

Open source · Built with Semgrep