Desktop app · Local security analysis

The security review your AI skipped.

AI assistants write code that works. VibeTect checks whether it’s safe — inspecting your project for exposed secrets, broken access control, unsafe authentication and risky configuration, on your own machine, before you deploy.

Get early access See how it works

Your code is analyzed locally. No repository access or code upload required.

app/api/invoices/[id]/route.tsAI-generated

1import { db } from "@/lib/db";

2import { getUser } from "@/lib/auth";

4export async function GET(req: Request, ctx: Ctx) {

5 const user = await getUser(req);

6 if (!user) {

7 return Response.json(null, { status: 401 });

8 }

10 const invoice = await db.invoice.findUnique({

11 where: { id: ctx.params.id },01

12 });

14 return Response.json(invoice);

15}

1import { db } from "@/lib/db";

2import { getUser } from "@/lib/auth";

4export async function GET(req: Request, ctx: Ctx) {

5 const user = await getUser(req);

6 if (!user) {

7 return Response.json(null, { status: 401 });

8 }

− const invoice = await db.invoice.findUnique({

− where: { id: ctx.params.id },

10+ const invoice = await db.invoice.findFirst({

11+ where: { id: ctx.params.id, ownerId: user.id },

12 });

13+ if (!invoice) {

14+ return Response.json(null, { status: 404 });

15+ }

17 return Response.json(invoice);

18}

components/BuyButton.tsxAI-generated

1"use client";

2import Stripe from "stripe";

4const stripe = new Stripe("sk_live_");01

6export function BuyButton({ price }: Props) {

7 const buy = async () => {

8 const s = await stripe.checkout.sessions.create({

9 mode: "payment",

10 line_items: [{ price, quantity: 1 }],

11 success_url: `${location.origin}/thanks`,

12 });

13 location.assign(s.url!);

14 };

15 return <button onClick={buy}>Buy now</button>;

16}

1"use client";

−import Stripe from "stripe";

−

−const stripe = new Stripe("sk_live_");

3export function BuyButton({ price }: Props) {

4 const buy = async () => {

− const s = await stripe.checkout.sessions.create({

− mode: "payment",

− line_items: [{ price, quantity: 1 }],

− success_url: `${location.origin}/thanks`,

− });

− location.assign(s.url!);

5+ const res = await fetch("/api/checkout", {

6+ method: "POST",

7+ body: JSON.stringify({ price }),

8+ });

9+ location.assign((await res.json()).url);

10 };

11 return <button onClick={buy}>Buy now</button>;

12}

api/search.pyAI-generated

1from fastapi import FastAPI

2from db import conn

4app = FastAPI()

6@app.get("/search")

7def search(q: str):

8 sql = (

9 "SELECT id, title FROM posts "

10 f"WHERE title LIKE '%{q}%'"01

11 )

12 rows = conn.execute(sql).fetchall()

13 return {"results": rows}

1from fastapi import FastAPI

2from db import conn

4app = FastAPI()

6@app.get("/search")

7def search(q: str):

− sql = (

− "SELECT id, title FROM posts "

− f"WHERE title LIKE '%{q}%'"

− )

− rows = conn.execute(sql).fetchall()

8+ rows = conn.execute(

9+ "SELECT id, title FROM posts "

10+ "WHERE title LIKE ?",

11+ (f"%{q}%",),

12+ ).fetchall()

13 return {"results": rows}

highResolvedroute.ts:11

Any signed-in user can read any invoice

Broken access control · CWE-639 · OWASP A01:2021

Why it matters: The query trusts the ID in the URL. Change /invoices/1042 to /invoices/1043 and you get someone else’s invoice — name, address and amount.
Fix: Scope the lookup to the signed-in owner and return 404 when nothing matches.

criticalResolvedBuyButton.tsx:4

Live payment key shipped to every visitor

Exposed secret · CWE-798 · CWE-200

Why it matters: "use client" bundles this file into JavaScript anyone can download. Whoever copies the key can act as your Stripe account.
Fix: Create the checkout session in a server route that reads the key from an environment variable. If this was ever deployed, rotate the key.

criticalResolvedsearch.py:10

The search box can run attacker-written SQL

SQL injection · CWE-89 · OWASP A03:2021

Why it matters: Input is pasted straight into the query. A search for ' OR 1=1 -- returns every post, and crafted input can read data from other tables.
Fix: Use a parameterized query so input is always treated as data, never as SQL.

Runs on your machineIllustrative demo — nothing on your device is being scanned

01
Local by design
Your project is inspected on your own device.
02
Assistant-agnostic
It checks the code itself, whichever AI wrote it.
03
Findings in plain English
What’s wrong, why it matters and how to fix it.

01The gap

“It works” is not a security review.

AI coding tools are very good at producing code that runs. Whether that code checks who is allowed to see what, keeps keys out of the browser, or treats user input as hostile is a different question — and it’s rarely the one you asked.

The result is software that passes every test you thought to run, then fails the first time someone tries something you didn’t. VibeTect exists to ask the questions your prompt left out.

Prompt: “Add an API route that returns an invoice by its ID.”
Result: Compiles without errors
Returns the right invoice
Passes your manual test
Missed: Checks that the invoice belongs to the person asking

What the research says

45%
of coding tasks produced code with an OWASP Top 10 vulnerability when Veracode tested more than 100 language models.
Veracode, 2025 GenAI Code Security Report(opens in a new tab)
86%
of relevant test cases failed to defend against cross-site scripting (CWE-80) in the same study.
Veracode, July 2025(opens in a new tab)
23.8M
new hardcoded secrets were found in public GitHub commits during 2024 — a 25% rise on the year before.
GitGuardian, State of Secrets Sprawl 2025(opens in a new tab)

Benchmarks measure controlled test tasks, not every real-world codebase. They describe the risk; they don’t predict your project. Read our summary of the research.

02What VibeTect checks

Five places AI-built software breaks first.

VibeTect is built around the mistakes that show up again and again in AI-assisted projects — and that are most likely to turn into real incidents. Select an area to see an example.

lib/supabase.tsExhibit 01

1import { createClient } from "@supabase/supabase-js";2 3export const supabase = createClient(4  process.env.NEXT_PUBLIC_SUPABASE_URL!,5  process.env.NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY!6);

FlaggedNEXT_PUBLIC_ variables are inlined into the JavaScript sent to every visitor, and a service-role key bypasses Row Level Security entirely.