Quick Answer
A Vibe Check is VibeDoctor's comprehensive automated diagnosis for AI-generated code. It runs 149+ checks across 21 diagnostic areas - covering security vulnerabilities, leaked secrets, dependency CVEs, code quality, AI-specific patterns, performance, SEO, SSL, and more. You get a Vitals Score from 0 to 100, every finding with its file path, line number, severity, and a copy-paste fix prompt for your AI coding tool. Results come back in under 5 minutes. Free tier included - no credit card required.
What Is a Vibe Check?
A Vibe Check is a full diagnostic for your codebase and live website. It examines your project from every angle that matters for production readiness: is the code secure, are the dependencies safe, does the live site perform well, are security headers in place, does the SSL certificate expire soon, are there runtime JavaScript errors, and does the code follow patterns that will not break under real-world conditions.
The diagnosis runs automatically. You connect a GitHub repo, a live URL, or both - and VibeDoctor handles the rest. No configuration files to write. No rulesets to customize. No CI pipeline to set up. Submit and wait for results.
When the check completes, you get a structured report organized by diagnostic area, with every finding showing exactly where the problem is and how to fix it. The entire process takes under 5 minutes for most projects.
The 21 Diagnostic Areas
A Vibe Check covers 21 distinct diagnostic areas - 14 that run against your code and 7 that run against your live site. Submit a GitHub repo and the code-side diagnostics run; submit a live URL and the live-site diagnostics run; submit both and you get all 21. Some areas only apply when they are relevant - a language toolchain for the languages you actually use, capability checks for the features you built, and the AI review layer on signed-in scans.
Code Diagnostics (GitHub Repo)
These run against your source code and dependencies.
| # | Diagnostic Area | What It Checks | Example Findings |
|---|---|---|---|
| 1 | Security Vulnerabilities | Unprotected routes, SQL injection, XSS, CORS, CSRF, eval(), insecure cookies, client-side secrets, and Stripe webhook flaws (20 checks) | API route without auth middleware, SQL query built by string interpolation, dangerouslySetInnerHTML with user input |
| 2 | Language Coverage | Security, quality, performance, frontend, and test rules implemented per language for TypeScript, JavaScript, Python, Go, Ruby, Java, PHP, and Rust | Python eval() caught by a Python-aware rule, Go SQL interpolation flagged with Go semantics rather than a generic regex |
| 3 | Secret Detection | API keys, passwords, tokens, private keys, and JWT secrets committed anywhere in the repo, via a battle-tested secret-detection engine (100+ rules) | Stripe secret key in a source file, AWS access key in config, RSA private key committed to the repo |
| 4 | Static Analysis (SAST) | AST-based pattern analysis (77 curated rules) across security, performance, quality, configuration, and error handling | User input flowing into a database call, console.log leaking data in production, an exception swallowed silently |
| 5 | Language Toolchains | Real compilers and linters run in a sandbox, one set per language: type-checkers, linters, and compile checks for TypeScript, Python, JavaScript, Rust, Go, Ruby, and PHP | A TypeScript type error the app ships around, a Python lint violation, a Rust correctness warning |
| 6 | Dependency Vulnerabilities | Known CVEs against the industry CVE database, plus dependency bloat, duplicate libraries, loose version pinning, missing lockfile, and packages verified against the live registry | Critical CVE in a pinned Next.js, package.json using "latest", import of a package that does not exist on npm |
| 7 | Capability Completeness | Detects what your app does (auth, payments, uploads) and checks the safety net each capability needs | Passwords stored without hashing, a Stripe webhook with no signature verification, an upload endpoint with no size limit |
| 8 | Code Quality | Unused imports, overly complex functions, god files and modules, route-handler bloat, missing error handling, commented-out code, TODO stubs, undeclared imports | A 600-line file doing five unrelated things, an async call with no try/catch, an import missing from package.json |
| 9 | Performance Anti-Patterns | await inside .map(), synchronous file I/O in async code, database queries inside loops (N+1), unbounded array growth, sequential awaits | 50 rows each triggering a separate query, readFileSync blocking the event loop, three awaits that could run in parallel |
| 10 | Frontend Quality | React/Vue/Svelte issues: direct DOM manipulation, accessibility violations, useEffect memory leaks, heavy bundle imports, missing key props, unsafe target=_blank, missing error boundary | setInterval with no cleanup, an icon button with no aria-label, full lodash pulled into the client bundle |
| 11 | Configuration & DevOps | Hardcoded localhost, unpinned Docker tags, missing .env.example, unstructured logging, TypeScript strictness disabled, missing health endpoint | FROM node:latest, tsconfig with strict:false, no /health route for orchestration |
| 12 | Testing | Test-to-source ratio, empty test bodies, tests without assertions, over-mocking, happy-path-only tests, missing test directory | it('works', () => {}) with an empty body, a suite that mocks everything and asserts nothing |
| 13 | Project Hygiene | .env committed, .gitignore quality, README presence, test directory, directory structure | .env committed to the repo, .gitignore missing node_modules, no README found |
| 14 | AI Analysis Layer | On signed-in scans, an LLM reviews high-risk files for logic-level security issues, and on paid plans reviews whether your architecture is complete | An auth check that passes the pattern scanners but is bypassable in logic, a payment flow missing idempotency |
Live Site Diagnostics (URL)
These run against your deployed website using a real browser session.
| # | Diagnostic Area | What It Checks | Example Findings |
|---|---|---|---|
| 15 | Performance | Lighthouse performance score, Core Web Vitals (LCP, FCP, CLS, TBT), Speed Index, Time to Interactive | LCP of 4.2s (should be under 2.5s), CLS of 0.31 (should be under 0.1), performance score 34/100 |
| 16 | SEO | Meta title, description, Open Graph tags, canonical URL, favicon, viewport tag | Missing meta description, no Open Graph image, canonical URL not set, missing viewport tag |
| 17 | Security Headers | HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy | No HSTS header, missing Content-Security-Policy, X-Frame-Options not set |
| 18 | SSL / TLS | Certificate validity, issuer and trust chain, days until expiry, protocol version | Certificate expires in 12 days, TLS 1.0 still enabled, untrusted certificate chain |
| 19 | Compliance & AI Readiness | Privacy policy, terms of service, refund policy, robots.txt, llms.txt, and JSON-LD structured data | No privacy policy linked, missing robots.txt, no JSON-LD for AI search and rich results |
| 20 | Exposure Probes | Publicly reachable sensitive files, admin panels, directory listing, error-page leakage, and live CORS wildcard | .env served over HTTP, /admin reachable without auth, Access-Control-Allow-Origin: * on the API |
| 21 | Live Website Analysis | Real-browser load: console errors, broken links, page weight and request profile, mixed content, DNS resolution, HTTP-to-HTTPS redirect | 7 internal links returning 404, images loading over HTTP on an HTTPS page, page weight 5.2MB |
The Vitals Score: One Number for Overall Health
After running all applicable diagnostics, VibeDoctor calculates a Vitals Score from 0 to 100. This single number summarizes the overall health of your project across every diagnostic area.
The score gives you an immediate answer to the question every builder asks: is this safe to ship?
| Score Range | What It Means |
|---|---|
| 80 - 100 | Production ready - no critical issues, strong security posture, good performance |
| 60 - 79 | Needs attention - some high-severity findings or performance gaps to address |
| 40 - 59 | Significant issues - multiple high or critical findings that should be fixed before launch |
| 0 - 39 | Not production ready - critical vulnerabilities present, do not ship without remediation |
The score is not a vanity metric. It is calculated from structured tool data - real vulnerability counts, real CVE severity levels, real Lighthouse measurements. Every point on the scale corresponds to real findings you can inspect and fix.
Severity Levels
Every finding from a Vibe Check is assigned a severity level:
- Critical - must fix before shipping. Leaked secrets, SQL injection, hardcoded private keys, known critical CVEs.
- High - should fix before shipping. Unprotected API routes, missing auth middleware, CORS wildcards, excessive dependency count.
- Medium - fix soon after launch. Mixed async patterns, god files, missing security headers, low test coverage.
- Low - nice to fix. Commented-out code, unused imports, missing README, hardcoded localhost URLs.
The severity classification is deterministic. It does not depend on AI interpretation or LLM confidence scores. Each check has a predefined severity based on real-world impact.
What You Get in the Report
Every finding in a Vibe Check report includes:
- Title - what the issue is (e.g., "Unprotected API route")
- Severity - Critical, High, Medium, or Low
- File path - exact file where the issue was found
- Line number - exact line in the file
- Description - what the issue means in plain language
- Fix guidance - what you need to change
- Copy fix prompt - a one-click button that copies a remediation prompt you can paste directly into Cursor, Claude Code, or any AI coding tool
The copy fix prompt feature is designed for vibe coders. You do not need to understand the vulnerability yourself. Copy the prompt, paste it into your AI tool, and the AI will fix the specific issue with full context about what was wrong and why.
How It Works
Running a Vibe Check takes three steps:
- Submit your project - enter a live URL, connect a GitHub repo, or both
- Wait for results - the diagnosis runs automatically and completes in 2-5 minutes for most projects
- Review your report - findings are organized by diagnostic area with severity, file paths, and fix guidance
No installation. No configuration files. No CLI to set up. Everything runs on VibeDoctor's infrastructure. You get the results in your dashboard at app.vibedoctor.io.
Continuous Monitoring: Stay Healthy After Launch
A single health check tells you where you stand today. Continuous monitoring keeps you healthy over time.
On paid plans, VibeDoctor automatically re-runs the health check on every git push to your connected repository. Every commit gets scanned. Every push generates an updated report. You never have to remember to run a check manually.
| Plan | Manual Scans / Day | Auto-Scan on Push | Scheduled Rescans | Weekly Digest Email |
|---|---|---|---|---|
| Free | 3 | No | No | No |
| Watch ($15/mo) | 10 | Yes | Weekly | Yes |
| Guard ($39/mo) | 50 | Yes | 3x per week | Yes |
| Shield ($79/mo) | 200 | Yes | 3x per week | Yes |
Push scan alerts notify you immediately when a critical or high-severity finding appears in new code. You find out about the problem within minutes of pushing - not days later when a user reports a bug or an attacker finds a vulnerability.
AI-Specific Checks: What Makes This Different
Traditional code analysis tools were built for professional engineering teams writing code by hand. They catch the problems that human developers make. VibeDoctor's Vibe Check includes an entire category of checks specifically designed for problems that AI coding tools create.
These AI-specific checks cover patterns that tools built before the vibe coding era were never designed to detect:
- Hallucinated imports - packages the AI referenced that do not actually exist on npm
- Empty test bodies - test functions with a title but no assertions inside
- Incomplete implementations - functions that throw "Not implemented" errors or have empty bodies
- God files - single files with 500+ lines doing too many unrelated things
- Mixed async patterns - files mixing .then() chains and async/await inconsistently
- Missing error boundaries - React apps with no ErrorBoundary component to catch runtime crashes
- Excessive dependency count - AI tools install packages liberally, often adding 60+ dependencies when 20 would suffice
- Duplicate functionality - AI installing both axios and node-fetch, or both moment and dayjs, for the same purpose
- N+1 database queries - database calls inside loops that should be batched
- Synchronous file I/O in async context - blocking the event loop with readFileSync when the surrounding code is async
These are not theoretical patterns. They appear in the majority of AI-generated codebases that VibeDoctor scans. The AI writes code that works functionally but introduces structural and safety problems that only show up under real-world conditions.
Copy Fix Prompts: From Finding to Fix in Seconds
Every finding in the report includes a "Copy Fix" button. Click it and VibeDoctor copies a detailed remediation prompt to your clipboard. The prompt includes:
- The exact file and line number
- What the issue is
- Why it matters
- What the fix should look like
Paste this prompt directly into Cursor, Claude Code, Copilot, or any AI coding tool. The AI gets full context and can fix the issue immediately. This creates a feedback loop: the AI built the problem, VibeDoctor diagnosed it, and the AI fixes it with the right guidance.
FAQ
How long does a Vibe Check take?
Most scans complete in 2-5 minutes. The exact time depends on repository size and whether you are scanning a live URL in addition to the codebase. URL-only scans typically finish in under 2 minutes. Large repositories with 1,000+ files may take closer to the 5-minute mark.
Is there a free version?
Yes. The free plan includes 1 scan per day with the full 149+ check diagnostic - no checks are removed or limited. You get the same report that paid users get. The difference is scan frequency: paid plans add automatic push scans, scheduled rescans, and weekly digest emails.
Can I scan a project without a GitHub repo?
Yes. You can submit a live URL only and get the 8 live-site diagnostics (performance, SEO, security headers, SSL, console errors, broken links, page weight, accessibility). To get the code-side diagnostics (security vulnerabilities, secrets, dependencies, code quality, vibe coding health, deep analysis, best practices), connect a GitHub repository.
What languages does the code analysis support?
The security, quality, and vibe coding checks support JavaScript, TypeScript, Python, Go, Rust, Java, Kotlin, C#, Ruby, PHP, Swift, Vue, and Svelte. Dependency vulnerability scanning works with any package manager that produces a lockfile (npm, pip, Go modules, Bundler, Composer, and more).
Do I need to install anything?
No. Everything runs on VibeDoctor's infrastructure. You do not need to install CLI tools, configure rulesets, or set up a CI pipeline. Create a project, submit your URL or connect your repo, and the health check runs automatically.