Deterministic rules
Shared rule engine patterns for hardcoded keys, JWT secrets, exposed DB URLs, and common auth mistakes.
Solutions · AI code security
AI can write the code. VibeSecur verifies the release.
Cursor, Lovable, Bolt, and other AI builders ship fast. Release Check surfaces secrets, auth gaps, risky dependencies, and configuration issues in the code you actually have — then labels whether the result is local preview or stronger evidence.
What this check covers
AI-built app patterns
Useful when generated clients put service keys or open data policies into front-end code.
Release decision
Verified / Review required / Blocked for the explicitly checked scope — not a vanity score alone.
Example signal
[SIGNAL] CRITICAL — Supabase service_role pattern in browser bundle [SIGNAL] HIGH — JWT secret assigned in source [RELEASE] Review required — 2 critical findings in checked files
In scope
- Paste/upload of supported source for local deterministic checks
- Signed-in MCP/project workflows where configured
- Findings with rule IDs, severity, and remediation hints
Limitations
- Not a full SAST/DAST suite or formal AI model evaluation
- Does not prove the running production deployment unless that scope is checked
- URL scanning is not a public enabled path until SSRF controls are live
Local result
Recorded result
Verified evidence
FAQ
Is this only for AI-generated code?
No. It works on any supported source. AI-built apps are a common entry path because they ship quickly with repeated secret and RLS mistakes.
Will you store my full source?
Scan metadata paths are designed not to retain full raw source. Local browser checks keep code in your browser unless you use a signed-in recorded workflow.
Is a clean check a security guarantee?
No. Results are evidence of performed checks for stated scope — not a guarantee the system is free of all vulnerabilities.