Ship fast with AI. Don't ship vulnerabilities.

You vibe, we watch your back. VibSec scans for secrets your agent leaks, flags exposed ports before they hit prod, catches supply chain attacks, and rolls back anything that goes wrong — so you can keep shipping.

▌ CLI + ◯ macOS Menu Bar App | OWASP LLM Top 10 + ASVS 5.0
Scan
Run
Rollback
Works with every AI coding agent you already use

What goes wrong when you vibe code without VibSec

AI agents write great code fast. They also leak secrets, expose databases to the internet, install typosquatted packages, and nuke your project. Here's the checklist.

🔑

"My agent committed my Stripe key"

AI autocomplete loves hardcoding secrets into config files. VibSec catches API keys, .env files, and private keys before they hit git.

🌐

"My MySQL was open to the internet"

Agents spin up dev servers on 0.0.0.0 and forget about it. VibSec monitors ports and flags databases, Redis, and services exposed to all interfaces.

📦

"It installed \"axois\" instead of axios"

Typosquatted packages are real supply chain attacks. VibSec flags 30+ known package impostors in your package.json and requirements.txt.

💣

"It rm -rf'd my entire project"

One bad command and everything is gone. VibSec auto-snapshots before every session so you can restore in 10 seconds, not 10 hours.

🚫

"eval(userInput) in production"

AI agents generate code with eval(), innerHTML, and SQL concatenation without thinking twice. VibSec flags every injection vector.

🔌

"Docker socket mounted in compose.yml"

Agents copy Docker configs from StackOverflow that mount /var/run/docker.sock. That gives containers full host access. VibSec catches it.

Your security checklist, automated

CLI for your terminal. Menu bar app for your dock. Both scan the same 30+ OWASP checks and show you exactly what needs fixing — before you ship.

Know exactly what's wrong before you ship

One command. 30+ OWASP checks. Finds the hardcoded secrets, eval patterns, and supply chain risks your AI agent introduced — grouped by severity so you fix what matters first.

Explore scanner
vibsec scan ./my-project
Hardcoded API key in config.ts:24Critical
.env contains production credentialsCritical
curl | bash pattern in setup.shHigh
eval() with untrusted input in api.js:87High
Unpinned dependencies in package.jsonMedium
.gitignore covers sensitive pathsPass
No exposed private keys foundPass
I let Claude Code build my whole auth flow. VibSec found a hardcoded Stripe key and an eval() with user input. Fixed both in 5 minutes.
👨‍💻
Vibe Coder
Shipping a SaaS with Claude Code

Snapshot, check, and audit every session

Launch your AI agent through VibSec. Your project is auto-snapshotted, the launch command is checked against your policy, and everything is logged to an audit trail — so you can always roll back.

Explore safety net
vibsec run -- claude
✔ Snapshot created: snap_a1b2c3d4Saved
✔ Policy loaded: vibsec.policy.jsonOK
✖ Launch blocked: rm -rf /Denied
✖ Launch blocked: cat ~/.ssh/id_rsaDenied
✔ Launching: claudeOK
✔ Session logged to audit trailLogged
My agent nuked my entire src/ folder. Ran vibsec rollback and was back in 10 seconds. This is a must-have.
👩‍💻
Solo Founder
Building an MVP with Cursor + AI agents

Your agent broke everything? Undo in one command.

Every vibsec run auto-snapshots your project. When your agent goes off the rails — and it will — one command restores everything with full integrity verification.

Explore rollback
vibsec rollback
a1b2c3d4 14 files · src/, config/ 2 min ago Restore
e5f6g7h8 8 files · package.json, api/ 18 min ago Restore
i9j0k1l2 3 files · .env, auth/ 1 hr ago Restore
m3n4o5p6 21 files · full project 3 hrs ago Restore

Security dashboard in your dock. No terminal needed.

Click the shield icon — see scan results, exposed ports, which agents are installed, and your full audit log. Same OWASP checks as the CLI, always one click away while you vibe.

Explore the app
Scan
Ports
Agents

VibSec

Monitoring
Scan
Agents
Ports
Audit Log
2
Critical
3
High
1
Medium
8
Pass
Hardcoded API key detected
config.ts:24LLM02
Critical
.env contains production credentials
.env:3LLM02
Critical
eval() with untrusted input
api.js:87LLM05
High
Weak crypto: MD5 hash detected
auth.ts:12ASVS V6.2.1
High
Cookie without Secure flag
session.js:45ASVS V3.4.2
Medium

Don't expose your database to the internet

AI agents spin up dev servers, databases, and caches on 0.0.0.0 without a second thought. VibSec's port monitor catches services exposed to all network interfaces — before your MySQL, Redis, or Postgres becomes public.

MySQL on *:3306 — your agent ran docker-compose up and the DB is reachable from any IP
Redis on *:6379 — no auth by default, any script on your network can read/write your cache
Mongo on *:27017 — "Shodan found your MongoDB" is a headline nobody wants
Dev server on 127.0.0.1:3000 — local only, no risk
Explore port monitoring
vibsec — port monitor
LISTENING PORTS · 5 detected · 3 exposed
:3306  MySQL      *:3306  → exposedHigh
:6379  Redis      *:6379  → no authHigh
:27017 MongoDB    *:27017 → exposedMed
:3000  Next.js    127.0.0.1 → localOK
:5432  Postgres   127.0.0.1 → localOK
I had no idea my Redis was listening on 0.0.0.0 until VibSec flagged it. Took 2 seconds to fix, could have been a data breach.
👨‍💻
Indie Hacker
Shipping a SaaS with Cursor + Claude Code

Everything an AI agent shouldn't do, caught.

10 checks that run in seconds. Zero config. Works on any project.

🛡️

Secret Detection

Scans for API keys, tokens, private keys, and .env files. Flags exposed ~/.ssh paths and keychains.

⚠️

Launch Command Check

Checks the launch command against your policy before execution. Flags dangerous patterns like rm -rf and git push --force.

📦

Supply Chain

Detects curl | bash patterns, missing lockfiles, unpinned dependencies, and typosquatted packages.

🔍

Output Validation

Catches unsafe patterns where model output flows to eval, exec, SQL, or template injection.

🧪

Data Poisoning

Scans training data and RAG files for prompt injection markers and chat template manipulation.

⏱️

Budget Enforcement

Detects when agent sessions exceed tool call limits. Rate limiting and per-session caps from your policy.

🔄

Instant Rollback

Automatic snapshots before every session. One command to restore any state.

📝

Audit Log

JSONL trail of every command, blocked action, and file change. Full visibility.

🌐

Port Monitoring

Catches MySQL, Redis, Mongo, and dev servers exposed on 0.0.0.0. Don't let your agent expose your DB to the internet.

🖥️

Menu Bar App

macOS tray app with live scanning, agent detection, port monitoring, and audit log — always one click away.

Three commands. You're covered.

No config files. No setup. Just scan, launch, and ship.

Step 01
vibsec scan

Scan Your Repo

Finds secrets, unsafe patterns, supply chain risks, and OWASP LLM + ASVS 5.0 vulnerabilities in seconds.

Step 02
vibsec run -- <agent>

Launch with a Safety Net

Auto-snapshots your project, checks the launch command against your policy, and logs everything to an audit trail.

Step 03
vibsec rollback

Undo Anything

Restore to any snapshot instantly. Full file contents preserved with integrity checks.

Comprehensive coverage.

VibSec maps to both the OWASP Top 10 for LLM Applications and the ASVS 5.0 standard — covering the risks that actually hit developers.

LLM01 Prompt Injection
LLM02 Sensitive Data
LLM03 Supply Chain
LLM04 Data Poisoning
LLM05 Output Handling
LLM06 Excessive Agency
LLM07 Prompt Leakage
LLM08 Vector/Embedding
LLM09 Misinformation
LLM10 Consumption

ASVS 5.0 Checks

V1.2 Injection Prevention
V1.3 Sanitization
V1.5 Safe Deserialization
V3.4 Browser Security
V4.1 Access Control
V5.1–5.5 Validation & Encoding
V6.2 Password Security
V7.1 Error Handling
V9.1 Communication Security
V10.2–10.3 Malicious Code
V11.3–11.4 Crypto & Hashing
V12.1 TLS Security
V13.1–13.4 API & Secrets
V14.2–14.3 Configuration
V15.3 Defensive Coding

FAQ

Can't find your answer here? Get in touch.

A security checklist for vibe coders. VibSec is a CLI + macOS menu bar app that catches the things AI agents get wrong — leaked secrets, exposed ports, typosquatted packages, unsafe eval patterns, and more. It maps to OWASP LLM Top 10 + ASVS 5.0, auto-snapshots for rollback, and runs 100% locally with zero config.

No. VibSec runs 100% locally. Your code, secrets, and audit logs never leave your machine. There are no external API calls, telemetry, or cloud dependencies.

VibSec works with any CLI-based agent — Claude Code, Cursor, Aider, Copilot, or custom agents. It snapshots your project before launch, checks the launch command against your policy, and logs everything to an audit trail.

VibSec maps its checks to both the OWASP Top 10 for LLM Applications (2025) and the OWASP ASVS 5.0 standard. It covers 8 of 10 LLM risks and 30+ ASVS checks across injection prevention, access control, validation, cryptography, API security, data poisoning, supply chain integrity, and more.

Yes. Run vibsec policy init to generate a policy file, then customize blocked commands, allowed paths, and severity thresholds for your project.

One command: curl -fsSL https://vibsec.com/install.sh | bash. Requires Node.js 18+. Installs globally so you can use it from any project directory.

One command. Zero config.

Install VibSec globally and start scanning any project in seconds. Requires Node.js 18+.

Terminal
curl -fsSL https://vibsec.com/install.sh | bash
1
Install

Run the command above. Downloads and installs globally via npm.

2
Scan

Run vibsec scan in any project to find vulnerabilities.

3
Launch

Run vibsec run -- <agent> to auto-snapshot and launch your agent with an audit trail.

Start vibing with a safety net.

Install in under a minute. Ship faster knowing nothing critical slips through.

Free to use. Read the FAQ.

Get in touch

Have a question or want to learn more? Drop us a message.