The vibe security scanner. An open-source, pre-launch production-readiness & security audit for vibe-coded projects. It tells you how far your project is from safe-to-launch — with
file:lineevidence, not vibes — and what to fix first.
🔒 Scan your project with GPT‑5.6 — free this week
Paste a public GitHub repo, get a 0–100 security score in ~30 seconds. No install.
Free hosted scan powered by GPT‑5.6 · limited spots daily · this repo is the exact engine it runs
What it checks — the 8 places vibe-coded apps get owned at launch. It detects what your project actually is and audits only the ones that apply (a static site won't get grilled on auth):
| # | Dimension | It looks for |
|---|---|---|
| 1 | Secrets & credentials | Hardcoded keys, committed .env, tokens in git history |
| 2 | Auth & access | Open databases, missing RLS, unauth endpoints, IDOR |
| 3 | Input & data safety | SQLi, XSS, no validation, PII in plaintext logs |
| 4 | Error handling | Unhandled async, stack traces leaked to users, crashes |
| 5 | Rate limiting | Unthrottled auth / OTP / LLM endpoints — the #1 vibe-coded miss |
| 6 | Deploy & config | Debug on in prod, wide-open CORS, missing security headers |
| 7 | Observability | Error tracking, logging, a health check — knowing when it breaks |
| 8 | Tests & CI | Whether anything actually verifies the critical paths |
Every finding comes back with the exact file:line, a severity (fatal / serious / minor), and
a copy-pasteable fix. See a full sample verdict in docs/example-report.md.
→ Scan your repo with GPT‑5.6 — free this week.
Paste a public GitHub repo URL, pick your report language, and you get the scored launch verdict — 0–100 per dimension, blockers roasted, fixes copy-pasteable — in about 30 seconds. Nothing to install: the scan runs online in a First Tree agent powered by GPT‑5.6, and this repo is the exact audit it runs — so you can read every rule it applies before you trust it.
- Picks a language — asks once what language you want the report in (中文 / English / 日本語 / …); all the human prose comes out in that language.
- Infers the audit tier from the code — no questionnaire. It defaults to Launch-ready and lets hard signals (a Stripe key, a users/password table) move it, then states the tier was inferred and lets you correct it in one line if the guess is wrong.
- Detects what the project actually is and audits only the applicable verticals — no fixed checklist, no inventing an auth finding for a static site.
- Judges each finding
fatal / serious / minor / passby per-tier rules, then maps findings to a verdict with a deterministic decision function (repeatable, not a vibe score). - Produces a report — a savage, screenshot-worthy scorecard (0–100 scores per dimension
and overall — numbers, never letter grades — with the blockers roasted) whose fix
instructions stay dead-serious and copy-pasteable — plus a machine-readable
scan-report.jsoncontract. On the closing prompt it can also file a GitHub issue per blocker in the scanned repo (opt-in — never automatic). The roast is full r/RoastMe register — it goes at the builder and the code both (their choices, habits, AI-slop-vs-古法 tells, and the launch-day disaster they're walking into), always earned by a realfile:linefinding, never a cheap insult.
| Tier | Roughly | Bar |
|---|---|---|
| Hobby / Demo | <10 users, no real data, not charging | Don't leak secrets, don't crash on the happy path |
| Launch-ready | hundreds of users, or handles real data, or about to launch | No exposed secrets, no open data, inputs validated, prod/dev split |
| Scale / Commercial | thousands+ users, or charging money, or live at size | Launch-ready + won't fall over under load + you'll know when it breaks |
The scanner infers the tier from the code (it doesn't ask): it defaults to Launch-ready and takes the highest tier the detected signals imply — real payment handling or thousands of users push it to Scale. The report says the tier was inferred and lets you correct it in one line.
The easiest path is the free hosted scan:
you connect a public repo, First Tree spins up an agent (powered by GPT‑5.6) that clones this repo,
runs the production-scan skill against your code, and posts the report back in the chat. The skill
asks one thing — your report language — then infers the audit tier from the code, runs the applicable
audits, and produces the scored verdict — then offers to file a GitHub issue per blocker (opt-in) or
hand the findings to a First Tree team to fix.
Under the hood it's a Claude Code skill
(.claude/skills/production-scan/) — fully open. Everything the audit does lives in SKILL.md and
references/ here, so you can read every rule before you trust the score. This repo is the single
source of truth: a push to the default branch is what every scan picks up next.
.claude/skills/production-scan/
SKILL.md # the meta skill: calibration, tier logic, run flow, judge model, report
references/
_TEMPLATE.md # the 5-section contract every vertical module follows
tiers.md # the 3 tiers + selection rule
secrets.md # per-vertical audit rules (applies-when · look-for · severity · examples · fix)
auth.md # also owns datastore authorization rules (RLS / Firestore / Storage)
input-data-safety.md
error-handling.md
tests.md
observability.md
deploy-config.md # owns CORS / debug-mode / source-maps / security headers
performance.md
rate-limiting.md # the #1 vibe-coded miss — unthrottled auth/OTP/LLM endpoints
ai-integration.md # AI-provider key exposure, spend caps, prompt injection, unsafe output
mobile.md # RN/Expo/native — token storage, bundled secrets, deep-link validation
docs/
ONBOARDING.md # how the scan runs + reading the report
DESIGN.md # full design doc (rationale, decisions, adversarial-review fixes)
REVIEWS.md # the dual-review trail (Codex + Claude), how the skill was hardened
example-report.md # a full sample report (English) — what a user gets back
example-report-zh.md # the same report in 中文
verticals/ # per-vertical design docs
Each finding maps to exactly one display dimension (no double-counting) — see the closed
id-prefix → dimension table in SKILL.md Step 2.4
and the cross-module ownership matrix in Step 4.
See a full sample verdict — scores, roasted blockers, and copy-pasteable fixes — in
docs/example-report.md (English) or
docs/example-report-zh.md (中文).
docs/DESIGN.md— why single-agent + reference modules (not multi-agent fan-out), the calibration→tier mapping, the findings→verdict decision function, the statically-provable vs. inferred honesty rule, and the report-artifact format.docs/REVIEWS.md— every vertical was researched (vs OSS prior art), designed, and dual-reviewed by Codex + Claude; the orchestrator was hardened over 10 adversarial Codex rounds (final verdict: ship).
Live. All 11 vertical modules + the meta orchestrator are built and reviewed. The eight
original verticals were dual-reviewed (Codex + Claude, see docs/REVIEWS.md);
rate-limiting, ai-integration, and mobile were added later, and the whole skill was re-hardened
across a further multi-round dual audit (2026-07).
🔒 Scan your project with GPT‑5.6 — free this week →
Paste a public repo · 0–100 score in ~30 seconds · every finding a real file:line
If this saved your launch, a ⭐ helps other builders find it.