About CheckVibe

Why we built it

More code than ever is written by AI: development teams ship with Cursor, Copilot, Claude Code, Lovable, Bolt and v0, and review can't keep up with the volume. That speed is a gift, but it routinely ships exposed secrets, missing access controls, open Supabase tables and vulnerable dependencies. CheckVibe exists to close that gap for teams without a dedicated security engineer: continuous security checks on every app, repo and pull request, with fixes written in plain language.

How it works

CheckVibe runs 100+ checks against your live app, including real Supabase RLS tests, and scans connected repositories for code flaws (SAST), vulnerable dependencies, secrets, licences, infrastructure-as-code and GitHub Actions. Findings are confidence-rated and de-duplicated, then paired with a fix. Plans add scheduled re-scans, alerting, a REST API and an MCP server; Team plans add pull-request reviews, AutoFix, seats and roles.

• OWASP Top 10 - the web application security risks our vulnerability scanners map to.
• Core Web Vitals (web.dev) - the field performance metrics our Performance pillar measures.
• CISA Known Exploited Vulnerabilities - the catalogue our dependency scanner ranks first.
• WCAG 2.2 (W3C) - the accessibility success criteria our WCAG audit evaluates.

Who it's for

Developer teams shipping AI-written code who need security coverage without standing up a security program, and the agencies building for them. Start with your live URL, then connect GitHub, GitLab or Supabase to cover the code, every pull request and the backend. A free account scans your website and your code.

Get in touch

Questions, partnerships or security disclosures are welcome. Reach us via the contact page, see live coverage on our status page, or explore the full list of security checks.