vibecheck

Security gaps in AI-generated code follow predictable patterns. Disabled row-level security in Supabase, hardcoded API keys, unauthenticated API routes, and missing CORS boundaries show up repeatedly in code scaffolded by Cursor, Lovable, Bolt, v0, Replit, or Windsurf. Generic vulnerability scanners miss these mistakes because they're not looking for the specific architectural oversights that AI generators tend to produce. Vibecheck fills that gap by bundling gitleaks, semgrep, and njsscan into a single workflow, then using Claude to analyze results and explain what actually matters. Rather than presenting raw scan output, it prioritizes findings by severity and business impact. For developers shipping fast, this triage layer saves hours sorting through false positives.

Getting started requires no account. Paste a live URL to check headers, TLS, CORS, and cookie flags immediately. Developers who want to scan source code can connect GitHub and run the full suite of 65 checks across 11 categories: secrets and exposure, access control, injection vulnerabilities, and server-side issues. The VS Code extension allows scanning before deployment without leaving the editor.

The feature set targets real vulnerabilities in rapidly developed applications. Beyond obvious issues like hardcoded JWT tokens or SQL injection, it catches subtle misconfigurations: NEXT_PUBLIC_ secret exposure, Supabase service role keys in client code, GraphQL introspection left enabled in production, and IDOR flaws from missing ownership checks. The 50 custom checks handle patterns that open-source scanners don't catch.

User testimonials reveal substantial value. One developer discovered a completely unsecured Supabase table during a pre-deployment scan. Another runs the scanner against five live products before every deploy, calling it the check they wished existed earlier in their career. The feedback emphasizes that Claude's triage actually reads like human review, not a generic wrapper around existing tools.

The freemium approach—allowing live URL scanning without registration and GitHub integration with no cost—targets independent developers and small teams. The Product Hunt and VS Code Marketplace presence indicate a distribution strategy built for developers who already use AI-assisted code generation.

For teams shipping applications with AI coding assistants, vibecheck addresses a real blindspot in existing security practices.