VibeAudit

Bug finder for AI-coded apps

Find the bugs your AI left behind.

Read from the server's disk as text. Nothing is executed.

Shallow-cloned to a temp folder and deleted afterwards.

/ lines · / KB
of audits left today · per hour each. Your code is sent to the model provider for analysis and isn't stored; reports expire after 24 hours. Don't paste real secrets.
CWE-798hardcoded secrets CWE-89SQL injection CWE-476null access CWE-362race conditions
Recent audits
Audit in progress

Auditing

%
Files
Segments
Findings
Filtered
Live log

The audit couldn't finish

How it works

From pasted code to a graded report.

2
Model calls per snippet
~40s
Typical snippet audit
0
Calls to repeat an audit
Lines per snippet
The pipeline

steps,

Scoring

How the grade is worked out.

Every finding that survives verification adds to a risk score from 0 to 100. Severity sets the weight and the model's confidence scales it, so one solid critical counts for more than a pile of style nits.

risk = Σ weight(severity) × confidencecapped at 100 · confidence is 0–1
  • Findings the verification pass rejects are removed before scoring.
  • Duplicates (same file and category, overlapping lines or near-identical titles) are merged, keeping the worst severity.
  • The list is ranked by severity, then confidence.
Try it

Add findings to see the score and grade move. This assumes full confidence for each one.

/ 100 risk
Coverage

What it looks for.

Every audit covers three areas and asks for specific bugs with a line number and a fix, tagged with a CWE where one applies. Typical finds:

Privacy & limits

What happens to your code.

Your code

  • The code is written to a temporary folder for the scan and deleted when it ends. Only the report is saved.
  • It is sent to the model provider () for analysis. Don't paste real secrets.
  • Secrets found in your code are masked in the report, for example sk_l***tUs3.
  • Each report has a long random ID, so only people with the link can open it.
  • Reports are deleted after 24 hours. Your history is kept only in this browser.
  • Reports are kept in a local SQLite file, data/vibeaudit.db.

Limits

  • Up to or per snippet.
  • Only a couple of audits run at once. If it's busy, you'll be asked to retry in a minute.
  • Pasting the same snippet again within 24 hours returns the saved report instantly, with no model calls and no quota used.
  • Folders, GitHub repos and the Docker sandbox are only available when you run VibeAudit yourself, because they would read files or run code on the server.
  • Local mode has no hourly or daily limits, and adds folders, GitHub repos and the Deep (Docker) scan.
Good to know

What it can't promise.

  • It can be wrong. The verification pass cuts false positives, but treat every finding as a lead to check, not a verdict.
  • Results vary a little between runs. Language models aren't deterministic, so a re-run can surface a different low-severity finding.
  • A clean grade isn't a security sign-off. It means nothing obvious was found in the code it saw, not that the code is safe.
  • It only sees what you paste. A snippet has no access to the rest of your project, so bugs that depend on other files can be missed.
  • Nothing is executed. This demo reads code; it never runs it, so crashes that only show up at runtime are out of scope.
  • If the model fails, you'll know. When no code could be checked the scan ends in an error instead of a clean grade, and partly checked reports are marked incomplete.

See it on real code.

The sample is a small Express API with about a dozen planted bugs: injection, broken auth, leaked keys and a checkout that always charges $0.