What VibeScan catches
Every scan runs 5 engines in parallel. Findings include severity, evidence, line numbers, and remediation hints.
Hardcoded secrets
Dual-engine detection: Gitleaks (regex, 150+ patterns) + Betterleaks (BPE token entropy scoring). Catches what regex alone misses.
Injection flaws
SQL injection, XSS, command injection, path traversal, open redirects. Opengrep SAST with custom VibeScan rules tuned for AI-generated patterns.
Vulnerable dependencies
Cross-references your package.json, requirements.txt, go.mod against OSV.dev (CVE, GHSA). Shows severity, affected versions, and fix version.
Hallucinated packages
AI models invent package names. VibeScan checks if each dependency actually exists on npm/PyPI. Phantom packages flagged instantly.
AI code anti-patterns
Purpose-built rules for patterns AI models produce: disabled CORS, eval(), hardcoded JWT secrets, permissive file permissions, debug mode in production.
Risk scoring
Every scan gets a 0–100 risk score based on finding count, severity distribution, and exposure surface. Track security posture over time.
Three steps. No setup beyond an API key.
VibeScan runs inside the AI tools you already use. No IDE plugins. No CI pipelines. No dashboard to learn.
Paste your code
In Claude or ChatGPT, share your code and ask for a security scan. Or call the API directly. Or connect a GitHub repo.
VibeScan analyzes it
Five engines run in parallel: secret detection, SAST, dependency audit, hallucinated package check, and AI pattern analysis. Results in seconds.
Your AI explains and fixes
Claude or ChatGPT reads the structured findings and explains each one in plain English. Ask for a fix — it writes one. No security expertise required.
Built for the AI-first developer
If you use AI to write code, you need VibeScan. AI is fast but not security-aware.
Cursor / Bolt / Lovable / v0 users
You ship fast with AI-generated code. VibeScan catches what the AI missed — hardcoded secrets, injection flaws, phantom dependencies — before your users find them.
Non-developers building with AI
You don't know what SQL injection is, and you shouldn't have to. Paste your code, and Claude or ChatGPT explains every vulnerability in words you understand.
Teams reviewing AI pull requests
Quick security sanity check on AI-generated PRs. Connect your GitHub repo, scan the code, get a risk score. No 45-minute SAST pipeline — just answers.
Solo devs who can't afford a security team
Enterprise security tools cost $50k+/year and take weeks to set up. VibeScan starts free, takes 2 minutes, and runs where you already work.
Start scanning in 2 minutes
Free tier. No credit card. 5 scans per month. Works in Claude and ChatGPT today.