New: CheckVibe MCP server — scan from Claude Code and Cursor nativelyRead the docs
Your AI editor ships your code. Did it ship your secrets?
Cursor, Claude Code, and Windsurf are the modern shipping pipelines. The same speed that makes them magical also makes them dangerous. AI assistants will happily commit `.env` files, log API keys to console, and write SQL string-interpolation that begs to be injected. Run CheckVibe after every shipping session.
Get a graded security report for your Cursor + Claude Code app in under a minute.
AI editors will sometimes echo your `.env` into a commit message or sample file. CheckVibe scans your live site for any of 30+ key shapes the AI may have leaked.
AI generates code that "looks fine" but interpolates user input into raw SQL. CheckVibe probes for it.
`console.log(error)` patterns common in AI-generated code leak stack traces to users.
AI-built forms frequently skip CSRF unless explicitly requested.
`Access-Control-Allow-Origin: *` is in the training data; AI uses it by default.
CheckVibe outputs ready-to-paste prompts ("Add CSRF to this route") tuned for Cursor and Claude Code.
Run `npx checkvibe` post-commit so secret leaks fail loudly.
AI follows leads — give it the lead.
AI sometimes leaks actual values into example files.
Yes. They can include secrets in suggested code, in `.env.example`, or in commit messages. CheckVibe scans your live deployment for exposed keys.
Every meaningful shipping session, yes. The fastest way is to add CheckVibe as a GitHub Action.
Your AI editor writes code. CheckVibe checks if it shipped safely. We also output AI-formatted fix prompts you can paste back into Cursor.
