securevibes.ogbuilds.aisecurity scores for vibe-coded apps
secure·vibes reads a github repo the way an attacker would, hunting committed secrets, injection-prone code, broken auth, and disabled tls. then it hands back a 0-100 score and six weighted subscores. every finding comes with file, line, and a ready-to-paste claude prompt.
secure·vibes20.4%
of 549 vibe-coded repos had a secrets finding
26.8%
had at least one critical or high finding
42.6%
used dangerouslySetInnerHTML — the top finding
securevibes rules-engine study · 549 public self-described AI/vibe-coded GitHub repos · july 2026 · read the full study →
secure·vibesbefore & after
an app that shipped before its security review
beforecommitted secrets and injection bugs sitting unseen
aftera 0-100 security score with six subscores, every issue found
knowing what's actually exploitable
beforea long scanner report full of noise and false positives
afterevery finding with file and line, ranked by severity
fixing the vulnerabilities
beforeresearch each issue and patch it by hand
aftera ready-to-paste claude prompt that fixes it: paste, diff, re-scan
simple pricing
Free
know your score before attackers do
4 credits · one free haiku scan
- security reviews on claude haiku
Pro
the full security pass, watched weekly
300 credits / mo · 30 scans
everything in free, plus:
- whole-repo reads on claude opus 4.8
- every finding double-checked by a second skeptical pass; false positives filtered
- weekly monitoring: re-scans + an email the moment your score drops
- scans your private repos
- export findings as github issues
- fix-everything mega-prompt
every plan includes
- 0-100 score + six subscores
- every finding with file + line
- ready-to-paste claude fix prompts
- shareable public reports + live readme security badge
a look inside
a few of the screens you'll actually use.
- 0-100 score + six subscores
- every finding, file + line
- ready-to-paste claude prompts
secure·vibeshow secure is your vibe-coded app?
paste a public github repo — get a security score, ranked findings, and the claude prompts that fix them.
secure·vibessecure·vibes guides
Ways to use secure·vibes, and how it compares.
- use caseVibe coding security risks: why AI-built apps ship the same six problemsVibe coding security risks follow a pattern: committed secrets, string-built SQL, debug mode left on. How secure·vibes catches what AI tools ship.
- how toThe pre-launch security checklist for vibe-coded appsSecurity checklist for vibe-coded apps: secrets out of the repo, SQL parameterised, debug off, .env ignored. Or scan it all at once with secure·vibes.
- how toHow to check a GitHub repo for security issues (by hand, and in one paste)Check a GitHub repo for security issues two ways: grep keys and eyeball SQL by hand, or paste the link into secure·vibes for a scored report in a minute.
- how toYou committed an API key to GitHub. Here's the order of operations.Exposed API keys on GitHub live on in git history after deletion. Rotate the credential, purge with git filter-repo, then prevent repeats with secure·vibes.
- use caseAI-code security scanner: what the category is for, and what to expect from oneAn AI code security scanner should check the mistakes AI tools actually make, point at exact lines, and hand back fixes. How secure·vibes approaches it.
- comparisonsecure·vibes vs Snyk and enterprise SAST: different tools for different buildersSnyk alternative for vibe coders: secure·vibes does fast heuristic repo scans with paste-ready AI fix prompts. Honest comparison with enterprise SAST/SCA.