VibeAudit

For Claude Code builders

Pre-launch security audit for apps built with Claude Code

Claude Code can build a complete product from a conversation. It is also very good at making code that runs, which is not the same as code that is safe to expose to strangers. An independent pass over the whole repository catches the assumptions that were never questioned during the build.

VibeAudit reads the full codebase in one pass with a security-first brief, verifies every serious finding a second time, and hands you a prompt per finding to paste back into Claude Code.

Scan your Claude Code project now — free, under a minute, no signup

Paste the GitHub repository URL. Public repos work as-is; sign in with GitHub for private ones.

Public repo URL, no signup. Private repo? Sign in with GitHub and pick it — read-only, nothing stored except the report.

What Claude Code apps usually ship with

From our audits of real repositories. Every item below is something the deep audit reports with file and line, plus a fix prompt.

Authorization gaps in generated CRUD

Every route checks the session; few check that the row belongs to the caller.

Env handling that differs between dev and prod

Fallback values that make local dev work (`|| 'localhost'`, `|| 'dev-secret'`) silently ship to production.

Payment logic that trusts the client

Prices, plans and trial lengths passed from the browser to Stripe.

Dev-only gates

Debug routes and seed scripts protected by `NODE_ENV` checks that are easy to get wrong on a host.

Read before you launch

  • API routes and server actions with no auth check · coming soon
  • Missing ownership checks (IDOR): reading and editing other users' data · coming soon
  • Supabase service-role and secret keys leaking to the browser · coming soon
  • Stripe webhooks, idempotency and billing logic bugs →
  • Dev-only gates, debug endpoints and NODE_ENV assumptions · coming soon

FAQ

Why not just ask Claude Code to audit itself?
You should, and it will find things. A separate pass with a different brief, the whole repo in context and no memory of why the code was written the way it was finds a different set. The deep audit is that second pass.
Is there a CI version?
Yes: the VibeAudit Scan GitHub Action posts a score and the top findings on every pull request. One line in your workflow, no API key.
Also for:LovableBolt.newv0CursorReplitPublic audits of popular starters →