VibeAudit

Pre-launch audit · powered by Claude Fable 5.1

You vibe-coded it.
Is it safe to launch?

Paste your GitHub repo. A frontier model reads the whole codebase — not a file at a time — and hands you a launch-readiness report: leaked keys, missing auth, broken payment logic, bugs users will hit. Each finding comes with a fix prompt you paste straight into Cursor or Claude Code.

Public repo URL, no signup. Private repo? Sign in with GitHub and pick it — read-only, nothing stored except the report.

✓ Free quick scan✓ Deep audit from $19✓ Results in minutes✓ Public repos: no signup · Private repos: GitHub sign-in
vercel/nextjs-subscription-payments · deep auditNOT READY
58/ 100 launch readiness
high
Checkout action trusts a client-supplied Price object — users can set their own trial length
utils/stripe/server.ts:76
high
'Manage' button creates a second Checkout session for subscribed users (double billing)
components/ui/Pricing/Pricing.tsx:189
high
Webhook returns 400 for unhandled events; Stripe will disable the endpoint
app/api/webhooks/route.ts:91
high
Password-confirmation check is dead code — password changes even on mismatch
utils/auth-helpers/server.ts:231

Real audit of a popular open-source starter. Full report (15 findings) · All public audits →

Reads the whole repo, not snippets

Claude Fable 5.1 has a 1M-token context. We feed it up to ~280K tokens of your source in one pass so it can trace a request from route → service → database and catch what file-by-file linters miss.

Findings you can act on in 30 seconds

Every issue has a file and line, the production impact, the fix, and a ready-to-paste prompt for your AI coding tool. No vague 'consider adding validation'.

Built for AI-generated code

Vibe-coded apps fail in predictable ways: keys on the client, missing ownership checks, permissive database rules, payment logic that double-charges. We look for exactly those first.

How it works

  1. 01

    Paste a repo URL — or pick a private one

    Public repos work with just a URL. For private repos, sign in with GitHub and install our app on only the repos you choose (read-only).

  2. 02

    Free quick scan

    A fast model reviews your highest-risk files and scores launch readiness. See titles of what it found.

  3. 03

    Unlock the deep audit

    $19. Claude Fable 5.1 reads the full codebase at high effort — usually 3–10 minutes.

  4. 04

    Paste the fix prompts

    Copy each finding's prompt into Cursor / Claude Code. Re-scan when you're done.

Pricing

One-time payments. No subscription. Pay with PayPal or card.

QUICK SCAN
Free
  • · Highest-risk files only
  • · Score + finding titles
  • · One free scan per repo per week
Run a scan
MOST POPULAR
DEEP AUDIT
$19 / repo
  • · Claude Fable 5.1, high effort
  • · Up to ~280K tokens of source
  • · Full findings + fix prompts
  • · Markdown export, shareable link
Start with a free scan
5-PACK
$49 / 5 audits
  • · Everything in Deep Audit
  • · Re-audit after fixing
  • · Credits on your account (or a license key), never expire
Start with a free scan

FAQ

Is my code stored?
We download a snapshot into memory for the duration of the analysis and keep only the generated report. We never push, fork, or store your source. Anthropic processes the request under its API data policy (30-day retention, not used for training). Full policy: /privacy
Do I need an account?
Not for public repos — paste a URL and go. Signing in with GitHub (free) unlocks private repos, keeps your audits and credits in one place, and raises the free-scan limit.
Private repos?
Yes. Sign in with GitHub and install the VibeAudit app on the repos you want audited — it gets read-only access to those repos only, and you can uninstall it any time. Private reports are visible only to you.
Is my code stored? (private repos)
Your GitHub token lives in an encrypted cookie in your browser and is used once per audit to download a snapshot into memory. We never store the token or the source; only the generated report is kept, and only you can see it.
What does the deep audit actually check?
Secrets, authentication and authorization on every route/action, database rules and RLS, input validation, webhooks and payment logic, upload handling, rate limiting on paid endpoints, error handling, async bugs, N+1 queries, serverless limits, and deployment config.
How accurate is it?
It reads real code and cites file:line, so findings are concrete. Like any reviewer it can miss things or flag a false positive — each finding carries a confidence level. It is not a replacement for a professional penetration test.
Refunds?
If the audit fails to run, you get a re-run or a refund. If it ran and you disagree with the results, email dlagywns9992@gmail.com and we'll take a look.
How do I reach you?
Email dlagywns9992@gmail.com. Include your audit link or license key if it's about a purchase.