qualityvibes.ogbuilds.aisecurity scores for vibe-coded apps
4.0(1)quality·vibes reads a github repo the way an attacker would, hunting committed secrets, injection-prone code, broken auth, and disabled tls. then it hands back a 0-100 score and six weighted subscores. every finding comes with file, line, and a ready-to-paste claude prompt.
quality·vibes20.4%
of 549 vibe-coded repos had a secrets finding
26.8%
had at least one critical or high finding
42.6%
used dangerouslySetInnerHTML, the top finding
quality·vibes (formerly secure·vibes) rules-engine study · 549 public self-described AI/vibe-coded GitHub repos · july 2026 · read the full study →
You could just paste it into Claude, and plenty of tools are exactly that with a wrapper on top. Two things here aren't.
Rules run before the model does. Whether your repo commits a .env file is a fact, not an opinion, and it shouldn't depend on which way a model leans today. 23.2% of the 1,969 Lovable apps we scanned commit one.
Then everything gets argued against. A second model reads each finding with the code around it and tries to knock it down, and what it disproves never reaches you. We ran that over 1,178 findings and 19.8% got dropped, including our own rules findings, which it disputes about as often as the AI's.
That second number is the one worth checking, so the whole dataset is published, every verdict included.
One scan returns two numbers. Security is one. Code cleanliness is the other, scored the same way. Both get ranked against repos we actually measured, so 72 means something: better than 71% of them, not 72 out of an imaginary hundred.
quality·vibesbefore & after
wondering whether this is just claude with a wrapper
beforepaste the repo into a chat, get a different answer every time you ask, and no way to tell a real bug from a confident guess
afterdeterministic rules run first, then a second model argues against every finding and drops the ones it can disprove
an app that shipped before its security review
beforecommitted secrets and injection bugs you don't know are there
aftera 0-100 security score with six subscores, every issue found
knowing what's actually exploitable
beforea long scanner report where you can't tell noise from a real bug
afterevery finding with file and line, ranked by severity
fixing the vulnerabilities
beforeresearch each issue and patch it by hand
aftera ready-to-paste claude prompt that fixes it: paste, diff, re-scan
a pull request you're about to merge
beforeread the diff yourself and hope you caught it
afterconnect github, pick an open pr, and the diff gets scored the way its repo does, every finding with file, line range and the change to make
secure but a mess to work in
beforenothing tells you the code is tangled until you go to change it
afterthe same scan hands back a cleanliness score with six subscores of its own, no extra charge
simple pricing
Free
know your score before attackers do
two scans on claude haiku, no card
- security reviews on claude haiku
Per scan
the full pass, bought one at a time
buy 1, 3 or 10
everything in free, plus:
- whole-repo reads on claude opus 5, or claude fable 5 on any single scan
- a second skeptical pass deletes the findings it can disprove: 19.8% of them, measured
- weekly monitoring: re-scans + an email the moment your score drops
- scans your private repos
- export findings as github issues
- fix-everything mega-prompt
every plan includes
- 0-100 score + six subscores
- every finding with file + line
- ready-to-paste claude fix prompts
- shareable public reports + live readme security badge
a look inside
a few of the screens you'll actually use.
- rules first, so the same repo scores the same twice
- 19.8% of findings dropped before you see them, measured and published
- ranked against 1,969 lovable apps and 549 ai-coded repos
- a second score for code cleanliness
- ready-to-paste claude prompts
- reviews an open pull request, scored like the repo it's opened against
- pr findings carry file, line range, severity and the change to make
quality·vibeshow secure is your vibe-coded app?
paste a public github repo. get a security score, ranked findings, and the claude prompts that fix them.
quality·vibesquality·vibes guides
Ways to use quality·vibes, and how it compares.
- use caseVibe coding security risks: why AI-built apps ship the same six problemsVibe coding security risks follow a pattern: committed secrets, string-built SQL, debug mode left on. How quality·vibes catches what AI tools ship.
- how toThe pre-launch security checklist for vibe-coded appsSecurity checklist for vibe-coded apps: secrets out of the repo, SQL parameterised, debug off, .env ignored. Or scan it all at once with quality·vibes.
- how toHow to check a GitHub repo for security issues (by hand, and in one paste)Check a GitHub repo for security issues two ways: grep keys and eyeball SQL by hand, or paste the link into quality·vibes for a scored report in a minute.
- how toYou committed an API key to GitHub. Here's the order of operations.Exposed API keys on GitHub live on in git history after deletion. Rotate the credential, purge with git filter-repo, then prevent repeats with quality·vibes.
- use caseAI-code security scanner: what the category is for, and what to expect from oneAn AI code security scanner should check the mistakes AI tools actually make, point at exact lines, and hand back fixes. How quality·vibes approaches it.
- comparisonquality·vibes vs Snyk and enterprise SAST: different tools for different buildersSnyk alternative for vibe coders: quality·vibes does fast heuristic repo scans with paste-ready AI fix prompts. How it compares with enterprise SAST/SCA.