Does Vibesecur work without an API key?
Trust▼Yes — fully. The local scan engine runs 60+ security checks entirely in your browser. No network needed. Zero cost. Add a Claude API key to unlock deep AI analysis, contextual fixes, and IP Passport generation.
Do you store my code?
Trust▼Never. Your code is processed in your browser and immediately discarded. Vibesecur servers are not in the path between your browser and the Claude API. Our database has no code column anywhere — we only store scan metadata (score, platform, issue count).
What apps does this work for?
Scope▼Web application source code only. We scan JS, TS, Python, JSON, and .env files from any AI tool — Cursor, Lovable, Bolt, v0, Replit, Google AI Studio, Emergent. We do not scan native iOS or Android code (those checklists are in our documentation), nor do we connect to your live database or deployed app infrastructure.
Will I get false positives?
Known Fault▼Yes, in local mode. The offline regex engine may flag variables named passwordStrength as a hardcoded password. The Claude AI mode is significantly more accurate — it understands context and reduces false positives dramatically. Always use AI mode for production code review.
Does Vibesecur catch IDOR vulnerabilities and business logic flaws?
Known Fault▼Not yet — this is our most significant limitation. IDOR (change user ID 123 to 124 in URL to see someone else's data), reversed auth middleware, and business logic flaws require running the actual application. Phase 2 includes dynamic testing (DAST). Pair Vibesecur with manual testing until then.
How much does it cost me for 1,000 users?
Cost▼In BYOK mode: ~$0. Users provide their own Claude API keys. Your servers just serve the HTML. If you host the API key for everyone: 1,000 users × 8 scans × ~1,400 tokens = 11.2M tokens/month. At Haiku 4.5: ~$16/month. At Sonnet 4.6: ~$48/month. With prompt caching in production: 60–90% cheaper.
If my app passes Vibesecur, is it secure?
Production▼Significantly safer, not guaranteed. Vibesecur removes the most common and easily-exploited vulnerabilities AI generates. It cannot replace a professional pentest, a SOC2 audit, or runtime behavioral testing. Think of it as the seatbelt — essential, but you still need airbags.