36 rules detect prompt injection, hardcoded secrets, and unsafe LLM patterns. Auto-scans every push. Findings appear directly in your PRs.
The Vibe Coding Security Crisis
Two-Layer Defense
Static analysis catches what's in the code. Behavioral probing catches what the model does at runtime. Most tools only do one.
Catches AI-specific and traditional vulnerabilities: prompt injection, hardcoded secrets, SQL injection, command injection, XSS, prototype pollution, insecure JWT, CORS misconfig, and more — across Python and JavaScript.
Tests your live LLM endpoints at runtime. Detects scope violations, prompt injection, data extraction attempts, and persona abandonment — the attack surface that static analysis can't reach.
Install in one click, pick your repos. Every push and PR is auto-scanned. Findings appear as Check Run annotations directly in your PRs — no CI setup, no config files, no pipeline changes.
Findings appear as Check Run annotations directly on your PRs — inline with your code. Track trends over time in the dashboard with severity breakdowns and remediation guidance.
A single 0-100 number and letter grade that summarizes your code's security health. Score deductions are weighted by finding severity and confidence — so you always know where you stand at a glance.
Enabled by default with a score threshold of 75. If a PR drops below the minimum score, the GitHub Check Run auto-fails — blocking the merge until issues are resolved. Fully configurable.
Every finding comes with a concrete code fix suggestion. On PRs, fixes are posted as GitHub Suggestion comments — one click to apply. Also visible in terminal, HTML reports, and the dashboard.
Why Code-Level Security Matters
Traditional tools scan your app after deployment. Vibe secures your code before it ships.
You need both layers — but without Layer 1, vulnerabilities reach production.
Get Running in Minutes
Three steps from install to your first security report.
Click "Install GitHub App", pick the repos you want scanned. Takes 30 seconds — no config files, no CI changes.
Every push and PR is automatically scanned with all 36 rules. Results appear as Check Run annotations directly on your commits.
Each finding shows the exact file, line, vulnerability type, and how to fix it. Track everything in your dashboard.
Competitive Landscape
Existing tools only solve half the problem. vibeCodeScan is the only tool that does both layers with zero config.
| Tool | Static Analysis | Behavioral Probing | OWASP LLM Coverage | Auto-Scan | Free Tier | Risk Score | Merge Gating | Autofix | Status |
|---|---|---|---|---|---|---|---|---|---|
| vibeCodeScan | ✓ 36 rules | ✓ 15 probes | ✓ Full | ✓ Every push | ✓ Free | ✓ 0-100 | ✓ Default ON | ✓ One-click | Active |
| Garak | ✗ | ✓ | Partial | ✗ | ✓ | ✗ | ✗ | ✗ | Active |
| Promptfoo | ✗ | ✓ | Partial | ✗ | Freemium | ✗ | ✗ | ✗ | Acquired by OpenAI |
| Manual Review | Slow | Incomplete | ✗ | ✗ | Human hours | ✗ | ✗ | ✗ | Unscalable |
| Generic SAST Tools | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | Active |
Privacy-First
Scans run through the GitHub API using the permissions you grant. We only store finding metadata — file name, line number, severity, and fix. Never your actual code, secrets, or PII.
🔒 Install GitHub AppQuestions
Benchmark Data
Live data from scanning public AI-generated repositories.