The official VS Code extension of vibesafe.info — an AI-powered security scanner built for vibe coders and non-technical founders using tools like Lovable, Bolt, Cursor, and Replit.

Scan the file you're working on and get plain-English security results without leaving your editor.

What it catches

🔑 Exposed API keys & secrets — hardcoded Stripe, OpenAI, Supabase keys
💉 SQL injection & XSS — user input reaching queries or the DOM unsanitised
🔓 Broken authentication — client-side-only checks, weak comparisons
🗄️ Supabase RLS issues — the #1 cause of vibe-coded app breaches
💥 Runtime errors — missing awaits, null risks, unhandled rejections
📦 Hallucinated packages — AI-invented imports that don't exist

Getting started (one-time, ~30 seconds)

Install the extension
Connect your free account — click Connect VibeSafe in the welcome message, or open the Command Palette (Ctrl+Shift+P) and run VibeSafe: Connect (one-click setup). Your browser opens, you sign in (free — no card), and the extension is set up automatically. No keys to copy.
Scan — open any code file and press Ctrl+Shift+V (Cmd+Shift+V on Mac)

That's it. If you ever see "connect" prompts, it just means step 2 hasn't happened yet on this machine.

How to use

Open any .js, .ts, .jsx, .tsx, .py, .java, .cs, .html, .css, .json, .env, .md, .yml/.yaml, or .sql file
Press Ctrl+Shift+V (Cmd+Shift+V on Mac) — or right-click → VibeSafe: Scan Current File
Issues appear as inline squiggles plus a results panel with plain-English explanations and fixes — including one-click Apply fix for issues with a safe automatic edit

You can also scan just a selection: highlight code → right-click → VibeSafe: Scan Selected Code. Results also live in the shield icon in the activity bar.