Security & performance scan for your vibe-coded app

A second opinion on everything your agent ships.

149+ automated checks across your repo and your deployed site. Secrets, phantom imports, open auth routes, dead performance. One ranked report in under 2 minutes.

or
  • Read-only access to your code
  • Never used to train AI
  • No credit card required
Works in
  • Claude Code
  • Codex
  • Cursor
  • Windsurf
  • Cline

What you get

Scan reportYour repo and live site, one ranked report
Scan complete
Overall score
61/100
Needs attention
Security48
Code quality63
Performance71
356 issues found
AllSecurityCodeSite
  • critical
    Stripe secret key committed to sourcelib/payments.ts:14
  • critical
    No rate limiting on /api/loginapp/api/login/route.ts
  • high
    Import of a package that does not existutils/slugify.ts:2
  • high
    CORS allows every originmiddleware.ts:31
  • medium
    Same fetch logic duplicated in 6 filescomponents/*
AnalyzeRiskiest code, ranked
1criticalgetStripeClient()

11 functions depend on it · 5 fixed, 3 new since last scan

FixDo this first

Move the Stripe key to an env var

Copy AI fix prompt
V In your agent

Fixed the Stripe key leak and added a rate limit to /api/login. Rescanning now.

Vibe X-RaySee how your code connects
16 findings
app api 9 components api/auth 5 lib route.ts
All modules › Api › api/auth316 features · main 4f2c1ab
Vibe StoryYour app, explained in plain English
Play
Modules › Shop › Checkout38 functions · 6 files
  1. 1
    Add to cart buttonAddToCartButton()
  2. 2
    Start checkoutcreateCheckoutSession()
  3. 3
    Payment confirmedhandleStripeWebhook()heads-up: Webhook signature not verified
Uptime & SEOUptime checked around the clock
Operational
Uptime, 30 days99.98%
Avg response222 ms
SSL certificate83 days
Response time
From your last scanSEO 92Performance 71Accessibility 88
What it checks

Six things agents get wrong on almost every project.

01 21 checks

Secrets and credentials

API keys, tokens and service credentials committed into source, env files or client bundles.

02 22 checks

Auth and access

Unprotected routes, no rate limit on login or sign up, permissive CORS, sessions that never expire.

03 8 checks

Dependencies

Hallucinated imports, unpinned versions, known CVEs and packages nobody ever installed.

04 29 checks

Vibe coding health

Duplicated logic, dead files, half finished refactors and TODOs the agent promised to come back to.

05 16 checks

Performance

Payload size, render blocking assets, unoptimised images and the requests that make first load crawl.

06 34 checks

SEO and best practices

Metadata, crawlability, accessibility basics and whether an AI search engine can read your pages.

See all 149+ checks across 21 diagnostic areas.

How it works

Paste, scan, fix.

01

Paste one line into your agent

It installs the MCP server itself. Nothing to configure, no dashboard to learn, no keys to paste.

02

Ask it to scan

149+ checks run across your source and your deployed URL in under 2 minutes, public repo or private.

03

Fix it in the same chat

Findings come back ranked with file paths, so the agent that wrote the code can go straight to fixing it.

4%

imported at least one package that does not exist

35%

had API keys or secrets committed to the repo

6%

had no rate limiting on auth endpoints

Measured across
1,099

repos scanned to July 2026

Live scan results

Apps getting checked right now.

Showing the latest 20 of 6,489 scans, including public repos we check around the clock

Country Language Findings When
🌐TypeScript381 files2 critical3 high65 medium54m ago
USPython1675 files3 high821 mediumAI Search ReadyCompliant56m ago
🌐Python3236 files10 critical2 high427 medium1h ago
🌐TypeScript6 files1 high2 medium3h ago
🌐Code0 files1 medium4h ago
FRWebsite1 high2 mediumAI Search ReadyCompliant4h ago
🌐C++1609 files6 critical27 high1193 medium5h ago
🌐TypeScript131 files3 critical11 high45 medium6h ago
🌐PHP619 files3 critical21 high217 medium6h ago
GBJavaScript236 files10 critical2 high465 mediumNot AI Search ReadyCompliant7h ago
GBPython307 files1 high1 mediumAI Search ReadyCompliant7h ago
🌐Python4 files10 medium7h ago
INTypeScript2822 files20 critical26 high2094 mediumAI Search ReadyCompliant7h ago
🌐JavaScript15 files3 critical32 high24 medium8h ago
🌐TypeScript71 files5 critical30 high62 medium10h ago
🌐TypeScript137 files10 critical53 high141 medium11h ago
🌐Python67 files1 high65 medium13h ago
🌐Python24 files1 critical19 high115 medium14h ago
GHWebsite3 criticalNot AI Search ReadyCompliant14h ago
BRJavaScript8 files2 high1 mediumAI Search ReadyCompliant14h ago
🌐Python84 files9 high310 medium15h ago
🌐Shell5 files2 medium16h ago
EEWebsite1 critical2 mediumNot AI Search ReadyCompliant1d ago
USWebsite1 mediumAI Search ReadyCompliant2d ago
PLWebsite3 critical1 high6 mediumNot AI Search ReadyCompliant3d ago
KRWebsite1 critical2 mediumAI Search ReadyCompliant3d ago
JOWebsite3 critical3 high2 mediumNot AI Search ReadyCompliant3d ago
CAWebsite3 critical1 high3 mediumNot AI Search ReadyCompliant3d ago
USWebsite3 highAI Search ReadyCompliant4d ago
INWebsite3 critical1 high5 mediumNot AI Search ReadyCompliant4d ago
KZWebsite2 critical2 mediumNot AI Search ReadyCompliant5d ago
INWebsite4 criticalNot AI Search ReadyNot Compliant5d ago
AEWebsite2 critical1 mediumNot AI Search ReadyCompliant6d ago
ISWebsite2 critical3 mediumNot AI Search ReadyCompliant7d ago
AUWebsite1 high6 mediumAI Search ReadyCompliant7d ago
NLWebsite1 high1 mediumAI Search ReadyCompliant8d ago
USWebsite3 critical2 mediumNot AI Search ReadyCompliant8d ago
ILWebsite2 critical1 mediumNot AI Search ReadyCompliant10d ago
USWebsite3 critical6 mediumNot AI Search ReadyCompliant10d ago
PKWebsite3 critical6 mediumNot AI Search ReadyCompliant11d ago
Vibe X-Ray

See what your agent actually built.

Every scan rebuilds a map of your codebase: modules, the sub-modules inside them, and the files where the findings actually sit. Follow the red down three levels and you land on the file to fix. Paste that one file into your agent instead of the whole repo.

All modules › Api › api/auth X-Ray ready
316 features detected 16 findings main 4f2c1ab 29 connections Sample project
31 18 204 96 47 Api 41 feat / 88 nodes 9 findings / health 38 App 118 feat / 214 nodes 4 findings / health 66 Components 96 feat / 181 nodes 3 findings / health 74 Lib 27 feat / 63 nodes health 91 api/auth 8 feat / 19 nodes 5 findings / health 24 api/stripe 6 feat / 14 nodes 4 findings / health 41 app/(dashboard) 34 feat / 61 nodes 4 findings / health 66 components/forms 22 feat / 38 nodes 3 findings / health 74 lib/db 11 feat / 24 nodes health 91 app/api/login/route.ts critical No rate limiting lib/session.ts high Session never expires app/api/webhook/route.ts critical Signature not verified lib/payments.ts critical Stripe key in source app/(dashboard)/page.tsx medium Missing page metadata components/UploadForm.tsx high No file type check lib/db/client.ts clean no findings
Unhealthy (<60) Fair (60-80) Healthy (>80)

Drill to the function

Module, then sub-module, then the file and the functions inside it. Findings are pinned to the symbol they came from.

Dead code and coverage

Two more tabs on the same map: what nothing calls any more, and which parts of the code no test touches.

Fewer tokens per prompt

Send the files a change actually touches instead of the repo. How Vibe X-Ray works.

On every plan, rebuilt on every scan. See pricing.

Questions.

Is VibeDoctor free?

Yes. Every new account starts with a Free Week: one project, one scan a day, and the full report, with no card required. Paid plans add more projects, a scan on every push, and PR review.

Can VibeDoctor scan a private GitHub repository?

Yes. Connect the GitHub App and access is scoped to read-only. We scan your code, then delete our copy automatically.

Does VibeDoctor modify or write to my code?

No writes. The scan reads your repo and your live site and returns findings. Any fixing happens in your editor, by you or your agent.

How do I connect VibeDoctor to Claude Code, Cursor or Codex?

Paste one line into the agent: connect to vibedoctor using https://vibedoctor.io/mcp/start. It fetches the instructions, installs the MCP server itself, and reports back in the chat you already have open. No keys to copy, no config file to edit.

How is VibeDoctor different from SonarQube, Snyk or CodeRabbit?

There is real overlap. VibeDoctor runs the same classes of engine they do: a SAST pass, secret detection, dependency CVE scanning, and each language's own linter and type checker (opengrep, gitleaks, trivy, ruff, biome, pyright, tsc, clippy, rubocop, phpstan). What it adds is your deployed site scanned alongside the repo (Lighthouse, security headers, SSL, SEO, exposed files, console errors), checks aimed at AI-generated code such as imports of packages that do not exist, and a graph of your codebase. It also runs from inside your agent over MCP, so findings arrive in the chat where the code was written.

4 more questions
What languages and frameworks does VibeDoctor scan?

JavaScript and TypeScript, Python, Go, Ruby, Java, PHP and Rust, with framework-aware checks for React, Next.js, Express, Fastify, Django, Flask, FastAPI, Rails and Spring. Anything the site-side checks can reach over HTTP is covered as well.

Is AI-generated code safe to ship?

It usually runs, and it usually ships with the same handful of holes: keys committed to source, auth routes with no guard, missing rate limits, imports of packages that do not exist. This is a scan for people shipping apps their agent mostly wrote, and it finds those before your users do.

How do I find hallucinated npm packages in AI-generated code?

Every scan verifies each dependency against the registry, so an import of a package that does not exist is flagged with its file and line. It is one of the most common AI-generated defects: 4% of the repositories scanned in production had at least one.

What is Vibe X-Ray?

A four-level visual explorer for your codebase: modules, files, symbols and the dependencies between them. It shows what your agent actually built - which functions call what, where complexity hides, and what breaks if you touch something. It updates with every scan.

Scan it before your users do.

connect to vibedoctor using https://vibedoctor.io/mcp/start

Or paste a repo URL and skip the setup entirely.

Featured on

Monitored by VibeDoctor VibeDoctor — Featured on LaunchBuck Featured on Lifto
Someone in the US scanned their app
824 issues found · scored 75/100