For Claude Code builders
Pre-launch security audit for apps built with Claude Code
Claude Code can build a complete product from a conversation. It is also very good at making code that runs, which is not the same as code that is safe to expose to strangers. An independent pass over the whole repository catches the assumptions that were never questioned during the build.
VibeAudit reads the full codebase in one pass with a security-first brief; the deep audit then re-checks every serious finding against the code a second time and hands you a prompt per finding to paste back into Claude Code.
Scan your Claude Code project now — free, under a minute, no signup
Paste the GitHub repository URL. Public repos work as-is; sign in with GitHub for private ones.
What Claude Code apps usually ship with
From our audits of real repositories. Every item below is something the deep audit reports with file and line, plus a fix prompt.
Every route checks the session; few check that the row belongs to the caller.
Fallback values that make local dev work (`|| 'localhost'`, `|| 'dev-secret'`) silently ship to production.
Prices, plans and trial lengths passed from the browser to Stripe.
Debug routes and seed scripts protected by `NODE_ENV` checks that are easy to get wrong on a host.
Read before you launch
- API routes and server actions with no auth check →
- Missing ownership checks (IDOR): reading and editing other users' data · coming soon
- Supabase service-role and secret keys leaking to the browser · coming soon
- Stripe webhooks, idempotency and billing logic bugs →
- Dev-only gates, debug endpoints and NODE_ENV assumptions · coming soon
FAQ
- Why not just ask Claude Code to audit itself?
- You should, and it will find things. A separate pass with a different brief, the whole repo in context and no memory of why the code was written the way it was finds a different set. The deep audit is that second pass.
- Is there a CI version?
- Yes: the VibeAudit Scan GitHub Action posts a score and the top findings on every pull request. One line in your workflow, no API key.