Updated July 2026

ALL 149+ AUTOMATED CHECKS

Every single check VibeDoctor runs on your codebase and live website - across 21 diagnostic areas, with language-aware checks for 8 languages and secret, CVE, and structure scanning for 40+ languages. No black boxes. Full transparency.

21
Diagnostic Areas
149+
Individual Checks
15+
Scanner Tools
<5 min
Full Scan Time

Including AI hallucination detection - catches npm packages and APIs that AI invented but don't exist.

🔒
SECURITY VULNERABILITIES
20 checks
Scans your code for OWASP Top 10 vulnerabilities, injection attacks, misconfigurations, and dangerous patterns that AI-generated code commonly introduces.
  • SEC-001Unprotected API routes - detects routes without authentication middlewareHighKnow more →
  • SEC-002SQL injection risk - string interpolation in database queries (6 patterns)CriticalKnow more →
  • SEC-003XSS vectors - dangerouslySetInnerHTML, innerHTML, v-html, {@html}, document.writeCriticalKnow more →
  • SEC-004CORS misconfiguration - wildcard origins and permissive Access-Control headersHighKnow more →
  • SEC-005CSRF / state-changing GET routes - mutations via GET requestsHighKnow more →
  • SEC-006Client-side secret exposure - sensitive env vars with NEXT_PUBLIC_/VITE_/REACT_APP_ prefixCriticalKnow more →
  • SEC-007Insecure cookie settings - missing httpOnly, secure, or sameSite flagsHighKnow more →
  • SEC-008eval() or new Function() usage - dynamic code execution risksHighKnow more →
  • SEC-009Insecure randomness - Math.random() in security-sensitive contextsHighKnow more →
  • SEC-010Missing input validation - route handlers without schema validation (Zod, Joi, etc.)MediumKnow more →
  • SEC-011Insecure file uploads - missing file type validation or size limitsHighKnow more →
  • SEC-012Rate limiting absent on auth endpoints - login/signup routes without throttlingMedium
  • SEC-013Debug mode in production - DEBUG=* enabled in production configurationHighKnow more →
  • SEC-014Hardcoded secrets - AWS keys, Stripe keys, OpenAI keys, GitHub tokens, Slack tokens, SendGrid keys, and generic secretsCriticalKnow more →
  • SEC-016JWT tokens in source code - hardcoded JWT tokens that should be runtime-generatedCriticalKnow more →
  • SEC-017No rate limiting - no rate limiting library or middleware detectedMediumKnow more →
  • SEC-018Stripe webhook object-type mismatch - renewal events read with the wrong object type, silently skipping renewalsMediumKnow more →
  • SEC-019Missing subscription cancellation handler - webhook handles payments but not customer.subscription.deletedHighKnow more →
  • SEC-020Stripe checkout without rate limiting - checkout/billing-portal sessions created with no throttleHighKnow more →
  • SEC-021Vulnerable framework version - project pins a framework release with known security advisoriesCritical
🌍
LANGUAGE COVERAGE
8 languages
The security, quality, performance, frontend, and testing checks above and below are implemented per language, so each one understands the idioms of your stack instead of applying JavaScript regexes to Python. Kotlin, C#, Swift, Vue, and Svelte files are recognized and covered by the universal checks, and secret detection, CVE scanning, and code structure mapping work across 40+ languages.
  • JS/TSJavaScript & TypeScript - React, Next.js, Express, Fastify, Node patternsDeepest
  • PYPython - Django, Flask, FastAPI patterns, eval/exec, asyncio anti-patternsDeep
  • GOGo - SQL interpolation, unsafe templates, goroutine leaks, ignored errorsCovered
  • RBRuby - Rails N+1 queries, html_safe XSS, bare rescue, hallucinated gemsCovered
  • JAVAJava - Spring REST endpoints, SQL concatenation, unescaped outputCovered
  • PHPPHP - SQL concatenation, unescaped echo, hallucinated Composer packagesCovered
  • RSRust - hallucinated crate imports, plus compiler and linter toolchain passesCovered
  • ALLUniversal - Docker tags, .env.example, TypeScript strictness, health endpoint, test dirs (any stack)Any stack
🔑
SECRET DETECTION
13 patterns Secret Scanner
Deep scan of every file in your repository for leaked credentials, API keys, and tokens using a battle-tested secret-detection engine with 100+ built-in rules.
  • GIT-001AWS Access Key IDs (AKIA*) and Secret Access KeysCriticalKnow more →
  • GIT-002Google Cloud, Azure, DigitalOcean, and Heroku keys and service account credentialsCriticalKnow more →
  • GIT-003GitHub personal access tokens and OAuth tokensCriticalKnow more →
  • GIT-004Stripe live and test keysCriticalKnow more →
  • GIT-005OpenAI / Anthropic / AI provider API keysCriticalKnow more →
  • GIT-006Slack, Discord, and Telegram bot tokensCritical
  • GIT-007Database connection strings (MongoDB, PostgreSQL, MySQL, Redis)Critical
  • GIT-008SendGrid, Mailgun, and email service API keysCritical
  • GIT-009Firebase / Supabase credentialsCriticalKnow more →
  • GIT-010SSH and PGP private keysCritical
  • GIT-011Twilio, Razorpay, Shopify, Cloudflare, and other SaaS / payment provider tokensCritical
  • GIT-012Generic passwords and secrets in config filesMediumKnow more →
  • GIT-014JWT signing secrets and encryption keysCritical
🧬
STATIC ANALYSIS (SAST)
77 rules AST Engine
AST-based static analysis with a curated ruleset. Parses your code into syntax trees, so it catches patterns that plain text matching misses - across JavaScript, TypeScript, Python, and more.
  • SAST-SECSecurity rules - injection, XSS, secrets, authentication, and unsafe API patternsCritical-HighKnow more →
  • SAST-PERFPerformance rules - blocking calls, wasteful loops, unbounded workMediumKnow more →
  • SAST-QUACode quality rules - dead code, console.log in production, TODO placeholdersLow-MediumKnow more →
  • SAST-CFGConfiguration rules - hardcoded localhost, unsafe defaultsMedium
  • SAST-ERRError handling rules - swallowed exceptions, missing catch pathsMedium
🛠️
LANGUAGE TOOLCHAINS
10 tools Sandboxed
Real compilers and linters - the same ones professional teams run in CI - executed against your code in an isolated sandbox. Each brings hundreds of its own rules on top of the checks listed on this page.
  • TSTypeScript - full type-check of your TypeScript projectMedium
  • PY-TYPEPython - static type checkingMedium
  • PY-LINTPython - fast linting (flake8 / pylint rule families)Medium
  • JS-LINTJavaScript / TypeScript - lint passMedium
  • RS-LINTRust - linting with the official Rust lint suiteMedium
  • RS-BUILDRust - compilation errors without a full buildMedium
  • GO-LINTGo - aggregated linters (staticcheck / vet families)Medium
  • GO-VETGo - official correctness analysisMedium
  • RB-LINTRuby - style and correctness lintingMedium
  • PHP-STATICPHP - static analysisMedium
📦
DEPENDENCY VULNERABILITIES
8 checks + CVE scan CVE Database
Scans your dependencies for known CVEs (Common Vulnerabilities and Exposures) against the industry CVE database, plus checks for bloat, duplicate libraries, hallucinated packages, and supply chain risks.
  • DEP-001Excessive dependency count - flags 40+ or 60+ production dependenciesMedium-HighKnow more →
  • DEP-004Duplicate functionality libraries - multiple HTTP clients, date libs, validators, etc.MediumKnow more →
  • DEP-006Potentially unused dependencies - production deps not imported anywhereMediumKnow more →
  • DEP-007Full import of heavy libraries - importing all of lodash, moment, rxjsMediumKnow more →
  • DEP-008Loose version pinning - using *, latest, or >= in package.jsonHighKnow more →
  • DEP-009No lock file - missing package-lock.json, yarn.lock, or pnpm-lock.yamlHighKnow more →
  • DEP-010Multiple package managers - conflicting lock files from npm + yarn + pnpmMediumKnow more →
  • PKG-VERIFYRegistry verification - every import checked against the live npm/PyPI registry to catch hallucinated and slopsquatted packagesHighKnow more →
  • CVE-SCANKnown CVE scan - checks all dependencies against the National Vulnerability DatabaseCriticalKnow more →
🧩
CAPABILITY COMPLETENESS
19 checks
Detects what your app actually does (auth, payments, file uploads) and then verifies the safety net that capability requires is present - the checks that ask "you built login, but did you build everything login needs?"
  • AUTH-HASHPassword hashing - passwords stored with bcrypt/argon2, never plaintext or weak hashesCritical
  • AUTH-RATE-LIMITLogin rate limiting - brute-force protection on auth endpointsHigh
  • AUTH-TOKEN-EXPIRYToken expiry - session/JWT tokens carry an expirationHigh
  • AUTH-CSRFCSRF protection present for cookie-based sessionsHigh
  • AUTH-SESSION-MGMTSession management - logout/invalidation paths existMedium
  • AUTH-EMAIL-VERIFYEmail verification flow for new accountsMedium
  • AUTH-HTTPS-ONLYAuth cookies restricted to HTTPSMedium
  • PAY-WEBHOOKPayment webhook handler exists - subscriptions don't silently driftCritical
  • PAY-SIGNATUREWebhook signature verification - events proven to come from the payment providerCritical
  • PAY-IDEMPOTENCYIdempotency handling - duplicate webhook deliveries don't double-charge or double-grantHigh
  • PAY-AMOUNT-VALIDATIONServer-side amount validation - prices never trusted from the clientHigh
  • PAY-ERROR-HANDLINGPayment error handling - failed charges have a code pathHigh
  • PAY-REFUNDRefund handling - refund events update your databaseMedium
  • UPLOAD-PATH-TRAVERSALPath traversal protection - filenames sanitized before hitting the filesystemCritical
  • UPLOAD-SIZE-LIMITUpload size limits enforcedHigh
  • UPLOAD-TYPE-VALIDATIONFile type validation - MIME/extension allowlists on uploadsHigh
  • UPLOAD-STORAGESafe storage location - uploads kept out of the public web rootMedium
  • UPLOAD-CLEANUPTemp file cleanup - failed uploads don't accumulateMedium
  • UPLOAD-VIRUS-SCANMalware scanning consideration for user-supplied filesLow
🛡️
SECURITY HEADERS
6 checks
Validates your live website's HTTP security headers against best practices. Missing headers are the #1 issue we find in vibe-coded apps.
  • HDR-001Strict-Transport-Security (HSTS) - forces HTTPS on all connectionsHighKnow more →
  • HDR-002Content-Security-Policy (CSP) - prevents XSS and injection attacksHighKnow more →
  • HDR-003X-Content-Type-Options - prevents MIME type sniffingMediumKnow more →
  • HDR-004X-Frame-Options - prevents clickjacking attacksMediumKnow more →
  • HDR-005Referrer-Policy - controls information leaking via referrer headersMediumKnow more →
  • HDR-006Permissions-Policy - restricts browser features (camera, microphone, etc.)MediumKnow more →
🔐
SSL / TLS CERTIFICATE
5 checks
Validates your SSL/TLS certificate status, expiry, and protocol version to ensure encrypted, trusted connections.
  • SSL-001HTTPS enforcement - site accessible over HTTPSCriticalKnow more →
  • SSL-002Certificate validity - certificate is valid and not expiredCriticalKnow more →
  • SSL-003Certificate trust chain - issued by a trusted Certificate AuthorityHighKnow more →
  • SSL-004Certificate expiry warning - expires within 30 daysMediumKnow more →
  • SSL-005TLS protocol version - using modern TLS 1.2 or 1.3MediumKnow more →
⚡
PERFORMANCE
10 metrics Lighthouse
Runs Google Lighthouse on your live URL to measure real-world performance. Scores every Core Web Vital plus time-to-interactive benchmarks.
  • LH-001Performance score (0-100) - overall performance ratingScoreKnow more →
  • LH-002First Contentful Paint (FCP) - time until first content appearsMetricKnow more →
  • LH-003Largest Contentful Paint (LCP) - time until largest element rendersMetricKnow more →
  • LH-004Total Blocking Time (TBT) - time the main thread is blockedMetricKnow more →
  • LH-005Cumulative Layout Shift (CLS) - visual stability scoreMetricKnow more →
  • LH-006Speed Index - how quickly content is visually displayedMetric
  • LH-007Time to Interactive (TTI) - time until fully interactiveMetric
  • LH-008Accessibility score (0-100) - WCAG conformance ratingScore
  • LH-009SEO score (0-100) - search engine optimization ratingScore
  • LH-010Best Practices score (0-100) - web development best practicesScore
🔍
SEO META TAGS
7 checks
Validates essential meta tags for search engine visibility and social media sharing. If these are missing, your site is invisible to Google.
  • SEO-001Page title - <title> tag present and descriptiveHighKnow more →
  • SEO-002Meta description - informative description for search resultsHighKnow more →
  • SEO-003Open Graph title (og:title) - title for social media sharesMediumKnow more →
  • SEO-004Open Graph image (og:image) - preview image for social sharingMediumKnow more →
  • SEO-005Favicon - browser tab icon presentLowKnow more →
  • SEO-006Canonical URL - prevents duplicate content indexingMediumKnow more →
  • SEO-007Viewport meta tag - mobile responsiveness declarationHighKnow more →
📜
COMPLIANCE & AI READINESS
7 checks
The launch-essential pages and machine-readable files a real product needs: legal pages users and payment providers expect, plus the files that make your site visible to AI assistants and search engines.
  • COMP-PRIVACY-MISSINGPrivacy policy - linked from the homepage or reachable at a standard pathCritical
  • COMP-TERMS-MISSINGTerms of service page presentCritical
  • COMP-REFUND-MISSINGRefund / cancellation policy - required when the site shows e-commerce signalsCritical
  • COMP-ROBOTS-MISSINGrobots.txt present at the domain rootHigh
  • COMP-ROBOTS-BLOCKINGrobots.txt not blocking all crawlers - your site stays discoverableCritical
  • COMP-LLMS-MISSINGllms.txt present - AI-crawler guidance so assistants can cite your siteHigh
  • COMP-JSONLD-MISSINGJSON-LD structured data - the schema.org signal for AI search and rich resultsHigh
🚪
EXPOSURE PROBES
5 checks
Passive HTTP probes against your live site for the things attackers try first: exposed files, open admin panels, and leaky error pages. Read-only requests, never exploitation.
  • EXPO-001Sensitive files exposed - .env, .git/HEAD, wp-config.php and similar reachable over HTTPCritical
  • EXPO-002Admin panels reachable - /admin, /phpmyadmin, /wp-admin responding publiclyHigh
  • EXPO-003Directory listing enabled - server exposes folder contentsMedium
  • EXPO-004Error page leakage - framework and version strings in 404/500 responsesMedium
  • EXPO-005CORS wildcard on the live site - Access-Control-Allow-Origin: * observed in responsesHigh
🧹
CODE QUALITY
12 checks
Detects code smells, dead code, overly complex functions, and AI-hallucinated imports that are common in vibe-coded projects.
  • QUA-002Unused imports - imported modules never referenced in the fileLow
  • QUA-005Mixed async patterns - mixing .then()/.catch() with async/await in same fileLowKnow more →
  • QUA-006Overly complex functions - functions exceeding 50 linesMediumKnow more →
  • QUA-007God files - single files doing too muchMediumKnow more →
  • QUA-008God modules - files with 20+ exports, sign of a monolithMediumKnow more →
  • QUA-009Route handler bloat - inline handlers exceeding 20 linesMediumKnow more →
  • QUA-010Missing error handling - .then() without .catch(), async without try/catchMediumKnow more →
  • QUA-011Commented-out code - 3+ lines of dead code in commentsLowKnow more →
  • QUA-012Incomplete implementations - TODO placeholders and "not implemented" stubsMediumKnow more →
  • QUA-013Empty function bodies - placeholder functions with no implementationLowKnow more →
  • QUA-014AI-hallucinated imports - packages that don't exist on npm/PyPI/crates (AI invented them)HighKnow more →
  • QUA-015Undeclared imports - packages imported but missing from package.jsonMedium
🐌
PERFORMANCE ANTI-PATTERNS
6 checks
Catches code patterns that work in development but will crash or freeze in production - common in AI-generated code that hasn't been stress-tested.
  • PERF-001await inside Array.map() - creates sequential promises instead of parallelHighKnow more →
  • PERF-002Synchronous file I/O in async context - blocks the event loopHighKnow more →
  • PERF-003Database queries inside loops - N+1 query problemHighKnow more →
  • PERF-004Unbounded array growth - while loops with .push() and no size limitMedium
  • PERF-005Sequential awaits that could be parallelized - 3+ independent awaits in a rowMediumKnow more →
  • PERF-006JSON parse/stringify inside loops - repeated serialization overheadLow
🖥️
FRONTEND QUALITY
7 checks
Checks React, Vue, and Svelte component code for memory leaks, accessibility violations, and bundle size issues.
  • FE-004Direct DOM manipulation in React - using document.getElementById instead of refsMedium
  • FE-005Accessibility violations - images missing alt text, icon-only buttons without aria-labelMediumKnow more →
  • FE-006Memory leak in useEffect - setInterval/addEventListener without cleanupMediumKnow more →
  • FE-007Bundle-heavy imports - full lodash (72KB) or moment (300KB) in client bundleMedium
  • FE-008Missing key prop in list rendering - .map() without key causes reconciliation bugsMediumKnow more →
  • FE-009External links without rel="noopener" - target="_blank" security riskLow
  • FE-010No React Error Boundary - uncaught errors crash the entire appMediumKnow more →
⚙️
CONFIGURATION & DEVOPS
6 checks
Validates project configuration, Dockerfile hygiene, TypeScript strictness, and production readiness signals.
  • CFG-002Hardcoded localhost URLs - http://localhost in production code (not env fallback)LowKnow more →
  • CFG-004Unpinned Docker images - using :latest tag instead of specific versionsMediumKnow more →
  • CFG-005Missing .env.example - new developers don't know what env vars are neededMediumKnow more →
  • CFG-006No structured logging - 5+ console.log calls instead of a proper loggerMediumKnow more →
  • CFG-007TypeScript strict mode disabled - allows implicit any and null safety issuesMediumKnow more →
  • CFG-008Missing health check endpoint - no /health or /healthz for container orchestrationLowKnow more →
🧪
TESTING
6 checks
Evaluates test quality, coverage ratio, and common antipatterns. Most vibe-coded apps have zero tests - we check if yours are real or just placeholders.
  • TST-001Low test coverage ratio - test files vs source files below thresholdHighKnow more →
  • TST-002Empty test bodies - test("should work", () => {}) provides false confidenceHighKnow more →
  • TST-003Tests without assertions - test runs code but never checks resultsMediumKnow more →
  • TST-004Mock-everything antipattern - mocking all imports, testing nothing realMediumKnow more →
  • TST-005Happy-path-only tests - no error/edge case coverageMediumKnow more →
  • TST-006Missing test directory - sizable codebase with no tests/ or __tests__/ at allMedium
📋
PROJECT HYGIENE
5 checks
Basic project health checks - the fundamentals that vibe-coded projects often skip.
  • PRJ-001.env file committed - secrets may be exposed in the repositoryCriticalKnow more →
  • PRJ-002.gitignore quality - missing entries for node_modules, .env, dist, buildMediumKnow more →
  • PRJ-003Test files present - project contains test directories or test filesHigh
  • PRJ-004README exists - basic documentation for the projectMedium
  • PRJ-005Directory structure - organized into subdirectories vs flat structureLow
🌐
LIVE WEBSITE ANALYSIS
7 checks
Loads your live website in a real browser to catch runtime errors, broken links, page bloat, and mixed content warnings - and screenshots it at mobile, tablet, and desktop sizes.
  • WEB-001Console errors - JavaScript exceptions and console.error messages on page loadHighKnow more →
  • WEB-002Broken links - dead links that return 404 or fail to resolveMediumKnow more →
  • WEB-003Page weight & request profile - total download size plus request count by type (scripts, images, fonts)MediumKnow more →
  • WEB-005Mixed content - HTTP resources loaded on HTTPS pageHighKnow more →
  • WEB-006DNS resolution - your domain resolves correctlyHigh
  • WEB-007HTTP to HTTPS redirect - plain-HTTP visitors are upgradedMedium
  • RISK-001Google Web Risk lookup - your URL checked against malware, social engineering, and unwanted software threat listsCritical
  • SHOTSMulti-viewport screenshots - mobile (375px), tablet (768px), and desktop (1440px) captures on every scanCapture
🤖
AI ANALYSIS LAYER
2 reviewers
On top of the deterministic checks, an AI layer reads the highest-risk parts of your code the way a senior engineer would - catching what pattern matching alone cannot. These run on signed-in scans (not anonymous one-off scans).
  • AI-SECREVAI security reviewer - an LLM pass over high-risk files that validates detector findings and surfaces logic-level security issues (signed-in scans)Review
  • AI-ARCHArchitectural review - detects your app's capabilities (auth, payments, uploads) and reviews whether the architecture around them is complete (paid plans / Launch Audit)Review

TOTAL: 149+ CHECKS

57 code checks + 8 dependency & supply chain + 19 capability + 13 secret patterns + 5 hygiene + 6 headers + 5 SSL + 10 performance metrics + 7 SEO + 7 compliance + 5 exposure probes + 7 live-site checks = 149 distinct checks on every scan. Each code check is implemented per language, so it understands your stack's idioms.

On top of that, our AST-based SAST engine (77 rules), secret scanner (100+ rules), dependency CVE database, and 10 language compilers and linters each contribute hundreds of additional sub-rules.

← Back to VibeDoctor

Security and Performance for Vibe Coded Apps

YOUR CODE DESERVES
A SECOND OPINION.

21 scan areas
149+ checks
<3 min results
or Sign in with GitHub

No credit card. Read-only repo access. We never write or store your code.