What it does
VibeAudit is a pre-launch security and quality audit for apps built with AI tools such as Cursor, Lovable, Bolt, v0, Replit and Claude Code. You give it a GitHub repository and it returns a list of what could break, focused on areas like who can see which data, payment and webhook handling, and exposed secrets or unbounded AI endpoints. A free quick scan reviews the highest-risk files and shows a readiness score, the finding titles and the top finding in full with a fix prompt. Public repositories need no account; private ones need a GitHub sign-in with read-only access. A paid deep audit reviews more of the source together, within a context budget of about 280K tokens, and runs a second review on critical and high findings. It adds detailed findings, fix prompts, a shareable report and Markdown export. The site says repository snapshots are processed in memory, that only the generated report is stored, and that it never pushes changes to your repo. The submitted code is processed by an AI provider under its API data policy. The reports are AI-generated, can miss issues or flag false positives, and are not a substitute for a professional penetration test.
Capabilities
- Free quick scan with readiness score and top finding
- Fix prompts to paste into an AI editor, then re-audit after changes
- Deep audit with more source reviewed together and a second pass on serious findings
- Shareable report and Markdown export
- Private repository support through read-only GitHub access
- A GitHub Action is linked from the site
When to use it
- Checking an AI-built app for access, payment and secret-handling mistakes before launch
- Getting fix instructions you can hand straight to your coding assistant
- Re-checking a repository after applying fixes
