Vibe Check: Code and Website Scan for AI-Built Apps

In short

Vibe Check is the VibeDoctor scan. Add a GitHub repository, a live URL or both, and you get one report: a score out of 100, every finding ranked by severity with its file and line, and a prompt you can paste into your AI coding tool to fix it.

What it checks

Vibe Check covers 21 areas: 14 run on your code and 7 on your live site. Add a repository for the code side, a URL for the site side, or both for everything. The checks page lists every check.

Your code (GitHub repository)

Security: unprotected routes, SQL injection, XSS, CORS, CSRF, eval(), insecure cookies, client-side secrets and Stripe webhook gaps.
Secrets: API keys, passwords, tokens and private keys committed anywhere in the repository.
Dependencies: known CVEs, loose version pins, a missing lockfile, and imports of packages that do not exist.
Deep analysis: rules that follow user input into databases, files and the shell.
Language toolchains: real linters and type checkers for TypeScript, JavaScript, Python, Go, Rust, Ruby and PHP.
App safety nets: what your app does (sign-in, payments, uploads) and whether each has the guard it needs.
Quality, performance, frontend, config, tests and project hygiene: god files, N+1 queries, missing error handling, empty tests, a committed .env and more.

Your live site (URL)

Performance: Lighthouse score and Core Web Vitals.
SEO: title, description, Open Graph, canonical URL and viewport.
Security headers and SSL: HSTS, CSP and friends, plus certificate validity and expiry.
Exposure: reachable sensitive files, open admin pages and directory listings.
Real-browser load: console errors, broken links, page weight and mixed content.
Compliance and AI readiness: privacy policy, terms, robots.txt, llms.txt and structured data.

How it works

Add a project at app.vibedoctor.io with a GitHub repository, a live URL or both.
Start a scan. Most scans finish in a few minutes; large repositories take longer.
Open the report: the score, each area's result, and every finding ranked by severity.

There is nothing to install and no configuration file to write. VibeDoctor has read-only access to your code: we scan it, then delete our copy automatically.

What you get

A score out of 100. It comes from the scanners' results; AI never sets a score.
Every finding with its place: severity, file, line and what it means in plain language.
A fix prompt: one click copies a prompt with the file, line, problem and fix. Paste it into Cursor, Claude Code or any AI coding tool.

Severity is fixed per check, not guessed: critical means fix before you ship (leaked secrets, SQL injection, critical CVEs), high means fix soon (open API routes, CORS wildcards), and medium and low are worth cleaning up.

Plans

Every new account starts with a Free Week: one project, one scan a day, and the full report, with no card required.

Plan	Scans a day	Projects	Scan on every push	Pull request review
Free	1	1	No	No
Watch	10	3	Yes	No
Guard	50	10	Yes	Yes
Shield	200	25	Yes	Yes

Paid plans also send a weekly status email. The pricing page has the full comparison.

Use it from your AI app

With the VibeDoctor connector, Claude, ChatGPT, Codex or Claude Code can run checks while they write: vibedoctor_check checks the files they just changed, and vibedoctor_status reads your latest report.

FAQ

How long does a Vibe Check take?

Most scans finish in a few minutes. Large repositories, and scans of both a repository and a URL, take longer.

Can I scan only a website?

Yes. A URL-only project gets the live-site checks: performance, SEO, security headers, SSL, exposure, console errors, broken links and page weight. The code checks need a GitHub repository.

Which languages are covered?

Language-specific rules cover TypeScript, JavaScript, Python, Go, Ruby, Java, PHP and Rust. Secret and dependency checks work on any repository.

Do I need to install anything?

No. Everything runs on VibeDoctor. Create a project, add your repository or URL, and start a scan.

Is Vibe Check free?