Vibe Safe
The security scanner for AI-built apps
One thing I’ve learned while building VibeSafe:
Getting an AI-built app to work is surprisingly easy.
Knowing whether it’s safe is much harder.
Before launching, I’d personally check these 7 things:
1. 🔑 Secrets
Search your entire codebase for API keys, tokens, passwords, and database credentials.
2. 🔐 Authentication
Try accessing protected pages without logging in.
3. 🗄️ Database access
Check whether a user can access another user's data by simply changing an ID.
4. 🌐 API endpoints
Look for endpoints that perform sensitive actions without proper authorization.
5. 📦 Dependencies
Check what packages the AI added. You might not know what you're actually shipping.
6. 🐛 Error messages
Production errors shouldn't expose stack traces, database details, or internal paths.
7. 🤖 Don't trust the AI's "done."
Ask another tool—or another person—to review the code from an attacker's perspective.
The interesting part?
A founder can spend weeks building features and still miss one tiny security mistake that takes an attacker seconds to find.
That's actually why we're building VibeSafe: to give indie hackers a security checkpoint between:
“AI built it” → “I'm ready to ship it.”
Curious what other founders do:
What's your security checklist before launching an AI-built SaaS?
Even if it's just one thing, share it below. I'd love to turn the answers into a practical indie-hacker security checklist.
Build fast. Ship safe.
Building VibeSafe has taught me something I didn't expect:
Finding security issues is only half the problem. Helping people understand what to do next is just as important.
Our first approach was simple — scan the code, find issues, and show the results.
But as the scanner became more powerful, the results became more complicated.
A developer could see:
🔴 Critical issues
🟠 High-risk issues
🟡 Medium issues
📁 File locations
💻 Code snippets
🛠️ Recommended fixes
Technically, that's useful.
But for someone who isn't a security expert, it can quickly become overwhelming.
So we're changing the experience.
Instead of simply saying:
"You have 8 security issues."
We want VibeSafe to answer three questions:
1. What is wrong?
2. Why does it matter?
3. How do I fix it?
And then make it easy to fix → rescan → verify.
That's becoming an important part of what VibeSafe is about.
AI makes it incredibly easy to build an app quickly.
But getting from "it works" to "it's safe to ship" is a different problem.
That's the problem I'm trying to solve.
I'd love feedback from other founders:
When a security tool gives you a long list of issues, what information do you actually want to see first?
-
1I would show the release decision first, not the issue list: ‘safe to ship,’ ‘ship with accepted exceptions,’ or ‘block release,’ with the exact evidence behind that decision. Severity alone is hard to act on because eight findings can mean one real release blocker or eight low-context warnings. Then keep the fix → rescan → verify loop, but preserve which code version was scanned so the result remains reproducible after the next AI-generated change.
-
1
This is a really useful perspective. I especially like the idea of showing the release decision first rather than making users interpret a list of severity levels.
“Safe to ship / Ship with exceptions / Block release” could make the result much more actionable.
And the reproducibility point is important too. With AI-generated changes happening so frequently, knowing exactly which version was scanned and being able to compare the result after a rescan would make the fix → rescan → verify loop much more meaningful.
I’m going to add this to our product thinking. Thanks for the detailed feedback! 🙌
-
1Glad it's useful. I'd tighten my earlier wording to 'passes these release checks,' with the commit and scan coverage visible. A clean scan doesn't establish that the whole app is safe. That narrower label still helps someone decide what to do next without overstating what the scanner verified.
-
-
I've been building VibeSafe because I kept seeing the same pattern with AI-built apps:
The app works.
The UI looks good.
The deployment succeeds.
But what's actually happening underneath?
Are secrets exposed?
Is authentication implemented correctly?
Are there insecure endpoints?
Are there runtime errors?
Does the deployed app actually behave the way the builder thinks it does?
That's what we're trying to solve with VibeSafe.
We're currently testing a workflow that can scan code/files/GitHub, test a live website, and run Launch Check against the actual application.
I'm still figuring out what the minimum useful security check for an AI-built app should be.
If you build with Cursor, Claude, ChatGPT, Lovable, Bolt, Replit, etc. — what's the security check you wish existed before you hit “deploy”?
Hey Indie Hackers 👋
I’m building VibeSafe, a security scanner for apps built with AI.
AI makes it incredibly easy to build and launch software, but it’s also easy to accidentally ship security issues you didn’t notice.
VibeSafe helps AI builders find potential security problems before they ship.
I’m also working on VibeSafe Builder, where the goal is to make AI-powered building faster and more practical.
The bigger vision is simple:
Build with AI → Scan → Fix → Ship safely.
We’re still early, and I’d love feedback from other indie hackers and people who are vibe coding.
What’s the biggest security problem you’ve encountered when building with AI?
I’d love to hear what you think. 🚀
Website: https://www.vibesafe.info/
-
1
The recurring-use question seems important.
Are builders running VibeSafe on every release, or mainly before launch?
-
1
Ideally, both. VibeSafe can be used before launch for a deeper security check, but the bigger value is running it on every meaningful release so new AI-generated changes don’t introduce vulnerabilities, exposed secrets, or runtime issues. Think of it as a safety check in the development workflow—not just a final pre-launch audit.
-
1The recurring workflow is the more interesting test. I’d be curious to dig into what actual usage looks like once people start running it repeatedly. Happy to continue privately — what’s the best email to reach you on?
-
-
2 Comments
Yes. VibeSafe works with private GitHub repos, Cursor, and CI/CD.
🔒 Private repos: Connect GitHub and scan private repositories.
🖥️ Cursor: Use the VibeSafe Cursor/VS Code extension or MCP to scan while you code.
⚙️ CI/CD: Run VibeSafe from the CLI or GitHub Action to scan automatically on pull requests.
The goal is to catch security issues where you already work, rather than making you move your code into another workflow.
And for sensitive code, we recommend using the appropriate privacy/security settings and permissions for your environment.