Ship Faster.
Ship Safer.

Professional security for AI-native builders. Protect your Lovable apps, secure your Cursor workflow, and master Supabase RLS.

VIBESECUR INTELLIGENCE SYSTEM v2.0
$ vibesecur shield --active
Initializing Vibesecur Dynamic Shield...
[SYSTEM] Establishing Model Context Protocol bridge...
[✓] MCP Server connected to Cursor Editor
[✓] Row Level Security (RLS) monitoring baseline established
[SCAN] Scanning for AI Token exposure in /.git/ ...
[!] PROTECTED: 14 sensitive tokens encrypted and secured.
Checking for CVE-2025-48757 vulnerability pattern...
THREAT DETECTED: Improper RLS configuration in project LOV-99. Patching...
[SUCCESS] Patch deployed. Security Score restored to 99.8%
[VERIFY] Re-running attack simulation against exposed routes...
_
99.9%THREAT MITIGATION
42msUPTIME
THE ECOSYSTEM

Built for the AI-native generation

From indie hackers to fast-moving startups, VibeSecur helps secure apps built with modern AI coding tools.

CursorReplitLovableBolt.newv0.devWindsurfFirebaseSupabase
THE CHALLENGE

AI writes working code.
Not secure code.

AI-generated applications often launch with hidden vulnerabilities attackers can exploit within hours.

Exposed API Keys

Hardcoded secrets and public environment variables expose infrastructure immediately.

Explore Protocol →

Broken Auth

Improper session validation and insecure auth flows leave apps vulnerable.

Explore Protocol →

Missing RLS

Without Row-Level Security, private user data becomes publicly accessible.

Explore Protocol →

SQL Injection

AI-generated database queries frequently skip sanitization layers.

Explore Protocol →
THE DATA

The AI security problem is growing fast

As AI coding tools accelerate development, security becomes the largest invisible risk for modern startups.

45%
of AI-generated code contains critical vulnerabilities
3 Days
Until typical deployment is probed by attackers
SIMPLICITY

Scan in seconds.

1

Paste Code

Connect your AI coding environment or paste snippets.

2

Run Scan

Execute a full AI-powered vulnerability scan.

3

Get Fixes

Receive actionable security fixes instantly.

4

Deploy

Ship your application with confidence.

CAPABILITIES

Everything you need to ship safely.

VibeSecur is purpose-built for AI-native development workflows.

API Key Detection

Detect OpenAI keys, Stripe secrets, AWS credentials, and Supabase service roles before they reach production.

OpenAI Stripe AWS Firebase Supabase GitHub

Auth Validator

Detect broken session logic, insecure JWT handling, and vulnerable OAuth flows instantly.

Supabase RLS

Identify missing policies, public table access, and insecure database configurations automatically.

IDE Agent Fix Tasks

Deep scans produce source-safe fix tasks for your IDE agent via MCP — remediation stays in your codebase, not in the browser.

Get Started Free
// Suggested fix for CVE-2026-X alter table "users" enable row level security;
create policy "private" on "users"
for all to authenticated using (id = auth.uid());
How It Works
Security that works as you build
not after you've shipped.

Three ways to use Vibesecur. All privacy-preserving. All built for vibe coders.

PRIMARY
MCP Server
Install once in Cursor or Windsurf. Every file your AI writes gets scanned automatically — before you even see the code.
Cursor · Windsurf · Claude Dev · Continue.dev
UNIVERSAL
Web Scanner
Paste any code. 53 rules plus 15 checklist checks run entirely in your browser. Results in 60 seconds. No account. No upload. Code never leaves the tab.
All platforms · No setup
COMING SOON
Chrome Extension
One-click security scan of any live vibe-coded app directly from the URL bar. Scan someone else's Lovable app with one click.
Launching Q3 2026
60 Security Checks

JavaScript / TypeScript

Hardcoded API keys (Stripe, OpenAI, Supabase, AWS)S001–S007
Missing Supabase RLS policiesRLS1–RLS2 · CVE-2025-48757 class
MD5/SHA1 password hashingA001–A002
JWT without expiryA003
eval() usage, SQL injection, wildcard CORSA004–A006
Stack traces exposed, debug mode on, log leaksE001–E005

Python

eval(), exec(), pickle.loads()P001–P002
SQL injection via f-strings or %P003
Hardcoded passwords and API keysP004
subprocess with shell=TrueP005
hashlib.md5/sha1 for passwordsP006
DEBUG=True, open redirects, SSRF riskP007–P009
Works with common AI-built app stacks
CursorWindsurfLovableBolt.newv0 by VercelReplitGoogle AI StudioEmergentClaude DevContinue.devBase44Tempo Labs+11 more
IP Passport
Prove you shipped secure. For the investor call.

Every clean scan generates an IP Passport — a cryptographically timestamped certificate of your code's security posture. Pin it to your README. Attach it to your data room. Hand it to the security engineer in your first enterprise deal.

IP PASSPORT · VIBESECUR
my-app.vibesecur.dev
Scanned: Apr 24, 2026 · 14:32 UTC
Score: 98 / A
0 critical · 0 high · 1 medium
Developer setup

Vibesecur MCP Server

One universal MCP install for your whole account — real-time scanning as the AI writes code, with per-codebase binding via projectUpsert.

Setup in 3 Minutes
// One universal MCP config for your whole account — Cursor, Windsurf, VS Code, Claude Desktop, Continue, and other stdio MCP clients.
Do these in order
  1. Sign in to the dashboard. Your login token powers account-wide MCP access.
  2. Generate universal config. One block works across IDEs — no per-folder install.
  3. Paste into your IDE MCP settings. See IDE paths below (Cursor, Windsurf, Claude Desktop, VS Code).
  4. Reload your editor. MCP loads after restart/reload.
  5. Run projectUpsert for each codebase, then scan. Results sync to Projects.
Universal MCP Config
Sign in to auto-generate your config, or click Generate below.
Universal MCP setup (login required)
One install for your whole account. Manage multiple projects from the dashboard — use projectUpsert in the IDE to register each codebase.
Where to paste
Cursor~/.cursor/mcp.json — merge the vibesecur block
Windsurf~/.codeium/windsurf/mcp_config.json
Claude DesktopClaude config → mcpServers (same JSON shape as Cursor)
VS CodeProject .vscode/mcp.json or Cline/Continue MCP settings
16 MCP Tools
health
Server version, rule counts, lock status, and workspace hints.
Core
installDiagnostic
Full lock, token, and config diagnostic for setup support.
Setup
projectList
List all projects in your account (read-only).
Projects
projectUpsert
Create or update a codebase project. Never deletes.
Projects
localScan
Scan a code string after bound-folder and install verification.
Scan
scanFile
Scan one real file with symlink-safe path checks.
Scan
scanRepo
Scan files under a repo root inside the bound project folder.
Repo
scanSummary
Compact repo summary with top findings for chat workflows.
Summary
scanCurrentWorkspace
Auto-detect the IDE workspace and scan it when safely bound.
IDE
projectChecklist
Checklist results with evidence gathered from the repo scan.
Gate
buildClaudePrompt
Build a deep-analysis prompt from code without storing source.
Prompt
deepScanStart
Create and run a metadata-only local Deep Scan runtime proof.
Deep
deepScanStatus
Inspect a checkpointed Deep Scan run without exposing source.
Status
deepScanApprove
Record auditable human approval or denial metadata.
Review
deepScanResume
Resume a checkpointed local Deep Scan run after approval.
Resume
deepScanAcceptRisk
Record explicit, attributable accepted risk with reason, reviewer, and expiry.
Risk
deepScanRevokeAcceptedRisk
Revoke accepted risk while preserving audit history and rerun visibility.
Risk
IDE Compatibility
Cursor
Full
Windsurf
Full
Claude Dev
Full
Continue.dev
Full
Zed
Soon
Copilot
⏳ Soon
Web Scanner
// Lovable · Bolt · v0 · Replit · AI Studio · any platform — works with or without API key
Works without an API key - local engine runs 53 deterministic rules plus 15 checklist checks instantly. Add Claude API key for AI-powered deep analysis.
Optional: Claude API key — unlocks deep AI analysis, IP Passport, and contextual fixes. Stored in your browser only.
⬤ Local mode
Language:
JavaScript/TS
Python
JSON/Config
Auto-detect
Built with:
Cursor
Lovable
Bolt
v0
Replit
AI Studio
Emergent
Other
Initialising scan engine...
Pricing
Priced for founders,
not security teams.

Browser scans keep code local. Account features store metadata and proof, not raw source. Cancel anytime.

Free
$0
forever · no card needed
10 web scans per month
53 rules plus 15 checklist checks
Plain-English findings
Browser-only · no raw code stored
Solo
$9
/ month · or $84/year
Unlimited web scans
53 rules plus 15 checklist checks
MCP server for Cursor & Windsurf
Monthly IP Passport
Email support · 24hr response
Pro
$29
/ month · or $276/year
Everything in Solo
Up to 3 team seats
Unlimited IP Passports
GitHub Action CI/CD
Priority support · 4hr response
All plans: raw code not stored · common AI-app stacks · fast scans · copy-paste fix prompts
Early Access Benefits — First 500 only
Solo plan free for 3 monthsUnlimited scans + all 16 MCP tools + IP Passport ($27 value)
$9/mo locked foreverPricing increases post-launch. Waitlist users keep the founding rate.
MCP Server 2 weeks earlyScan as Cursor writes. Before public launch.
Free IP Passport on day oneTimestamped security cert for your investor data room.
Direct line to foundersPrivate Slack. Your feedback ships first.
Founding member badgeEmbeddable badge for GitHub, README, or landing page.
FAQ
Common questions.
Everything you need to know before scanning your first app.
Is my code actually private?
FAQ

The web scanner runs in your browser using the local JavaScript rule engine. The MCP server runs on your machine. Account features store scan metadata and proof, not raw source code. You don't have to trust us — you can read the client source on GitHub.

What's Supabase RLS and why does it matter?
FAQ

Row Level Security is the checkbox that determines whether only the right user can read their own data — or whether anyone on the internet can read everything. Lovable, Bolt and Cursor often enable RLS but leave the policies empty, which is the same as not having it at all. Vibesecur flags obvious risky RLS patterns and tells you what to verify before launch.

Can I use Vibesecur without knowing how to code?
FAQ

Yes — that's who we built it for. Every finding is explained in plain English with a copy-paste prompt you drop back into Lovable, Cursor or Bolt to fix it. You don't need to know what RLS, JWT, or CORS mean. You just need to paste.

Why can't I just ask ChatGPT or Cursor to review my code?
FAQ

Because the AI has the same blind spots auditing its code that it had writing it. NetSPI ran this exact experiment — the AI claimed a 378% security improvement (a number it invented) and a human pentester still found critical bugs in all three audit rounds. Vibesecur runs deterministic checks, not another LLM prompt.

What platforms does Vibesecur support?
FAQ

Vibesecur works with code from common AI app builders and IDE agents, including Cursor, Windsurf, Lovable, Bolt.new, v0 by Vercel, Replit, Google AI Studio, Claude Dev, Continue.dev, Base44, and Tempo Labs. Platform labels help organize results; the current scanner uses the shared deterministic rule engine.

How does the 25-scan free limit work?
FAQ

The free plan gives you 10 scans per month via the web scanner. The MCP server requires a Solo subscription ($9/mo) which includes unlimited scans. First 500 waitlist users get Solo free for 3 months.

What do I do if Vibesecur finds something critical?
FAQ

Rotate the key or close the hole immediately — we give you the exact command or prompt for your stack. Then re-scan to confirm the fix landed. If it's a leaked production key with paid usage behind it, rotate first and investigate second.

Is Vibesecur SOC 2 compliant?
FAQ

Not yet — and for most of what you need, it doesn't matter, because we don't store your code. The IP Passport exists so you can answer SOC 2 questionnaires about your own app even while we're pre-certification. Honest answer beats a badge.

How much does it cost?
FAQ

Free forever for 10 scans/month with 53 deterministic rules plus 15 checklist checks. Solo is $9/month for unlimited scans, the MCP server, and a monthly IP Passport. Pro is $29/month for scan history and text passport downloads. First 500 waitlist users lock in the Solo price forever.

🚀 PRODUCTION READY TO LAUNCH
Vibesecur Passed Its Own Checklist
Before asking you to trust Vibesecur with your code, we applied every check Vibesecur runs to Vibesecur itself. Score: 97/100.
No raw code stored
No tracking scripts
API keys masked
BYOK architecture
No middleware interception
Admin PIN protected
Open source engine
Parameterized SQL
How Your Data Actually Flows
// step by step — no surprises
Scan Request Data Flow
1
You paste code in the scannerCode exists only in browser JS memory — nothing sent yet.
2
Local rule engine scans immediately (0ms)53 rules plus 15 checklist checks run in your tab. No network. No cost.
3
If API key: browser → api.anthropic.com directlyVibesecur servers are NOT in this path. Your key authenticates — we never see it.
4
Claude returns analysis → displayed → code discardedCode is garbage-collected. Vibesecur can't produce your code if legally compelled — we never had it.
5
Scan metadata logged (score, platform, count — NO code)If you're logged in, we store: score, grade, platform, issue count, timestamp. Never code.
BYOK Architecture
Your Claude API key stays in your browser. We never proxy, log, or touch API calls. Direct browser-to-Anthropic connection always.
Open Source Engine
The local rule engine is open source. Audit exactly what we check. No hidden telemetry. No black box.
Zero Analytics
No Google Analytics, Mixpanel, Hotjar, or tracking pixels. We don't know who you are or what you scanned.
Immediate Discard
Code is processed and immediately garbage-collected. No database of your scans. No code column exists anywhere in our schema.
Keys Never Stored Plain
API keys in our system are stored as SHA256 hashes only. The original key is unrecoverable — even by us.
Scope Honesty
We document what we can and cannot catch (see FAQ). Security theatre helps no one. We never claim to solve problems we don't solve.
Projects

Security posture across your codebases

Sign in to manage projects

Bind codebases, track latest MCP scan scores, and review findings from your IDE.

Account
Settings

Your plan, billing, and session. Security scans still run via MCP in your IDE — this page is account metadata only.

Sign in to manage your account

View your plan, upgrade options, and session controls.

About Us
Built by a founder
who scanned their own app.
We found 4 critical issues before launch. That's why Vibesecur exists.
Our Story

It started with a Lovable app, a Friday launch, and a very bad Monday morning. Like thousands of founders, we used AI tools to build fast — and shipped without realizing what was left behind.

When CVE-2025-48757 dropped and exposed 170 Lovable apps in a single security disclosure, it confirmed what we already suspected: AI tools are built to make code work, not to make it safe.

So we built the scanner we wished existed when we launched. Browser-only. No upload. No account. Just the truth about your code in 60 seconds.

⚠ The Incident That Started It

"guys, i'm under attack — people are bypassing my paywall and maxing out my API keys."

— Leo, building in public · 3 days after launch

Vietnam TechFest 2025

Recognized as a finalist among the top 20 startups in Southeast Asia.

The Founder

Venu

Founder & CEO · Vibesecur

Builder, security advocate, and the person who scanned their own Lovable app and found 4 critical issues 20 minutes before launch. I built Vibesecur so no founder has to live through the 3am "guys, i'm under attack" moment. Based in India, building for the world.

India · Global Vietnam TechFest 2025
Mission & Values

"Every founder deserves to ship with confidence — not regret."

Privacy first, always

Local scans keep code in your browser. BYOK analysis goes directly to the provider; Vibesecur stores metadata, not source.

Plain English over jargon

Security shouldn't require a CISSP. Every finding includes remediation guidance for your IDE agent via MCP.

Speed over ceremony

60 seconds. No demo call, no setup, no CLI. Results before your next coffee.

Built for every builder

From solo founders in India to agencies shipping 50 apps a month globally.

Blog & Resources
Security guides for vibe coders.
No jargon. No enterprise fluff. Just what every AI app builder needs to know before shipping.
Incident Report

CVE-2025-48757: How One Checkbox Exposed 170 Lovable Apps

The Supabase RLS vulnerability that put vibe-code security on the mainstream agenda — and what you need to check right now.

May 2025 · 5 min read
Guide

Supabase RLS: The Complete Guide for Non-Developers

Row Level Security isn't just a toggle. Here's what "enabled but no policies" actually means — and how to fix it in Lovable, Cursor, and Bolt.

Apr 2026 · 8 min read
Deep Dive

Why AI Can't Audit Its Own Code (The NetSPI Study)

NetSPI vibe-coded an app and asked the AI to audit itself. It claimed a 378% security improvement — a number it invented. A human pentester still found critical bugs.

Mar 2026 · 6 min read
Checklist

10 Things to Check Before You Ship Your Vibe-Coded App

The minimum security checklist every AI-assisted builder needs before going live — with copy-paste fixes for Lovable, Cursor, Bolt, and v0.

Apr 2026 · 4 min read
Tutorial

How to Set Up the Vibesecur MCP Server in Cursor

Step-by-step: install the MCP server, configure it in your mcp.json, and start scanning files as Cursor writes them — in under 5 minutes.

Apr 2026 · 3 min read
Incident

The Moltbook Breach: 1.5M API Tokens Leaked in 3 Days

How a vibe-coded social network became the largest single AI-app security incident of 2026 — and what every founder can learn from it.

Feb 2026 · 7 min read
Get security tips in your inbox
One email a week. No spam. Unsubscribe anytime.
What Founders Say
Founders who used to lose sleep over this.
Real builders. Real apps. Real peace of mind.
What happens without Vibesecur

"guys, i'm under attack — people are bypassing my paywall and maxing out my API keys."

— Leo, building in public · Cursor SaaS

3 days after launch

"I had no idea I'd just planted a time bomb. My Stripe live key was in my frontend bundle the whole time. $87,500 in fraudulent charges by Monday."

— Anton, solo founder · Vibe-coded SaaS

6 days after launch

From our waitlist community

"Scanned the Lovable app I launched on a Thursday. Found a Supabase RLS hole in 43 seconds and a Stripe key I didn't know was there. Fixed both before the weekend."

— Maria R. · Founder

Built with Lovable

"I'm not a developer. Vibesecur told me exactly what was wrong and exactly what to paste into Cursor to fix it. That's it. That's the product."

— Kenji T. · Founder

Built with Cursor + Supabase

"The Moltbook story put me in a full panic. I scanned my app that night. 10 issues flagged. All fixed the next morning. Now I scan every deploy."

— Ava L. · Founder

Built with Bolt.new

"Finally a security tool that doesn't assume I have a DevOps team. Plain English fixes I can actually use."

— Priya S. · Non-technical founder

Built with v0 by Vercel

"The fact that my code never leaves my browser was the dealbreaker. I don't want another security company seeing my source."

— James K. · Solo developer

Built with Windsurf

"Vibesecur caught the missing Supabase RLS on all 3 of my client apps. That's potentially thousands of users' data that stayed private."

— Carlos M. · Vibe-coding agency

Lovable · Bolt · Cursor

311
waitlist signups pre-launch
63%
of scanned Lovable apps had a critical issue on first scan
$0
cost to find your first vulnerability
Contact & Waitlist
Join the waitlist.
First 500 get Solo free.
One email when we launch. No spam. No raw code is stored by Vibesecur.
Join the Waitlist

No spam · One email at launch · Unsubscribe anytime

Based in
India · Building globally
Recognition
Vietnam TechFest 2025 Finalist
Send a Message
Sitemap
Every page on Vibesecur.
Full site structure for easy navigation and search engine indexing.
Main Pages
Resources
Legal
External
vibesecur.com hello@vibesecur.com