The road so far — and what's ahead.
VibeScan is under active development. This is the honest version of where things stand: what you can use today, what exists but isn't switched on yet, and what we're building next.
We don't put dates on unshipped work. The order below is the order we intend to build in, and it can change if the people using VibeScan tell us it should.
Live website scan
ShippedVerify a domain by DNS TXT record, then scan it for security-header gaps, weak TLS, publicly reachable .env and config files, missing cookie flags, and outdated client-side JS.
GitHub repo scan
ShippedConnect a public or private repo through GitHub OAuth and run static analysis, dependency CVE checks, infrastructure config auditing, and secret detection across files and git history.
Plain-English reports
ShippedEvery finding translated into what it means, why it matters, and how to fix it — not a raw JSON blob you have to interpret yourself.
REST API
ShippedTrigger scans and read findings programmatically with an API key, against any domain or repo you've already authorized.
MCP server
ShippedConnect VibeScan to Claude Code, Claude Desktop, or Cursor, so your coding agent can check for known issues and start a scan mid-session.
Scheduled auto-scans
ShippedRe-scan verified domains on a recurring cadence, so a change that introduces a problem gets caught without you remembering to look.
Penetration testing
Built, switched offAI-driven active exploitation testing that confirms whether a finding is actually reachable, with a mandatory human-review checkpoint before anything runs against a real target.
Built and tested, deliberately switched off. No customer can trigger a live run yet — the authorization paperwork this needs isn't finished, and we won't ship active testing without it.
Security posture trend
Rolling outA chart of your findings over time, per domain and per repo, so you can see whether the fixes you've been making are actually moving the number down — plus a per-target page collecting that target's full scan history in one place.
Built and merged. Switched on for a small group first so we can watch it against real scan histories before opening it to everyone.
Client-side secret exposure detection
ShippedCatches secrets shipped to the browser because they were given a framework's public env-var prefix — NEXT_PUBLIC_, VITE_, REACT_APP_. Common in AI-generated code, because the agent doesn't always know that prefix means the value is served to every visitor. Runs as part of the repo scan's static analysis.
Where this fires the fix isn't only a code change — the exposed value has to be rotated at the provider, because it may already have been served to real visitors.
Auth misconfiguration checks
PlannedProvider-aware rules for Clerk, Supabase Auth, and NextAuth — middleware that looks like it protects a route but doesn't run on it, session checks skipped in one path, service-role keys reachable from user input.
Slack and Discord alerts
PlannedGet pinged in your own channel the moment a new Critical finding appears, instead of finding out whenever you next open the dashboard.
Alerts fire on genuinely new findings only. Re-notifying about the same unchanged issue every cycle is how a channel gets muted.
CI/CD pre-merge check
PlannedA GitHub Action that scans every pull request and posts findings as a PR comment, so problems surface during code review. Optionally fails the check on Critical findings so branch protection can block the merge.
One-click fix → pull request
PlannedGenerate the actual patch for a finding and open a pull request against your repo, so you review a real diff instead of hand-writing the fix.
Mechanical, low-risk fixes only to start — headers, config, env-var renames. Anything needing an understanding of your business logic stays a human decision.
Want something moved up the road?
This order isn't fixed. If one of these would make a real difference to how you ship, tell us — it's the most direct way to change what gets built first.