# VibeZero

> VibeZero (tagline: Security AI PM) is an automated Security PM and release-readiness gate for apps built with AI and no-code tools. Connect a GitHub repo and a live URL; VibeZero scans five layers (code, dependencies, secrets, config, and the running app), returns one clear go/no-go release decision with a 0-100 launch readiness score, turns findings into AI-agent-ready fix tasks, and rescans to independently verify each fix. The first 3 scans are free.

## What it does

- Scans five layers: code (SAST), dependencies (SCA), secrets, configuration, and the running app (DAST), mapped to the OWASP Top 10 and OWASP API Top 10.
- Produces one go/no-go release decision plus a launch readiness score that tracks security posture over time.
- Explains every finding in business language: what happened, why it matters, what can go wrong, with the raw technical evidence one click deeper.
- Generates agent-ready fix tasks (context, affected files, acceptance criteria) formatted as prompts for Cursor, Claude Code, and Codex.
- Rescans after a fix ships and marks the finding Verified Fixed only when the rescan confirms it.
- Enforces launch policies: the configurable rules that decide what blocks a release.
- Secures the agent layer: Skill Security reviews agent skills for unsafe instructions, and the Claude.json scanner audits agent config for risky MCP servers, over-broad permissions, and leaked keys. An MCP Firewall that guards MCP traffic at runtime is in development.

## Who it is for

- Builders shipping apps made with Lovable, Bolt, Base44, Replit, and similar AI/no-code builders.
- Product teams and agencies that need a repeatable release-readiness gate and client-ready reports.

## Key pages

- [Homepage](https://vibezero.io/): product overview, how it works, pricing, and FAQ.
- [Homepage as Markdown](https://vibezero.io/index.md): the landing page rendered as plain markdown for agents (also available by requesting the homepage with `Accept: text/markdown`).
- [Free URL scan](https://vibezero.io/scan): a passive, no-signup scan of any public URL. One request for the page plus the same-origin scripts it loads, checking HTTPS and redirect behavior, security headers, cookie flags, and client bundles for exposed Supabase, Stripe, AWS, GitHub, and model-provider keys. It never probes hidden paths and is capped below launch-ready by design, because it cannot see the code, dependencies, git history, or deployment config.
- [Free tools](https://vibezero.io/tools): a hub of single-purpose security tools, all free and none requiring an account. Some read a public URL through the same passive scan described above; others analyse a value pasted by the user and run entirely in the browser, transmitting nothing. Current tools:
  - [Security headers checker](https://vibezero.io/tools/security-headers-checker): ten response-header checks on a URL (Content-Security-Policy and its weaknesses, frame protection, nosniff, Referrer-Policy, Permissions-Policy, server version disclosure, CORS wildcard), each with config for Vercel, Netlify, Next.js, Cloudflare Workers and Express.
  - [Exposed API key scanner](https://vibezero.io/tools/exposed-api-key-scanner): reads the JavaScript a URL loads and reports Supabase service_role and anon keys, Firebase config, Stripe live and test secret keys, AWS access keys, GitHub tokens, private keys, model-provider keys and hardcoded bearer tokens.
  - [Cookie security checker](https://vibezero.io/tools/cookie-security-checker): the Secure, HttpOnly and SameSite flags on the cookies a URL sets.
  - [CSP validator](https://vibezero.io/tools/csp-validator): analyses a pasted Content-Security-Policy, including the cases where strict-dynamic or a nonce cancels a directive out. Runs in the browser.
  - [Supabase key checker](https://vibezero.io/tools/supabase-key-checker): decodes a pasted Supabase key in the browser and reports whether it is the publishable anon key or the service_role key that bypasses row level security. The key is never transmitted.
- [MCP](https://vibezero.io/mcp): how a coding agent connects to a project's fix board over the Model Context Protocol, with per-client setup snippets.
- [Trust Center](https://vibezero.io/trust): repository access, isolated scanning, tenant security, target safety, and data-handling commitments.
- [Privacy Policy](https://vibezero.io/privacy): how account, repository, scan, billing, and analytics data is handled.
- [Terms of Service](https://vibezero.io/terms): authorized scanning, acceptable use, subscriptions, and service limitations.

## For AI agents

- [API catalog](https://vibezero.io/.well-known/api-catalog): machine-readable API discovery (RFC 9727, application/linkset+json).
- [OpenAPI document](https://vibezero.io/openapi.json): the public REST surface of the control plane at https://api.vibezero.io.
- [MCP server card](https://vibezero.io/.well-known/mcp/server-card.json): the VibeZero Security Fix Board MCP server (SEP-1649). A coding agent can connect over MCP at https://mcp.vibezero.io/mcp with a per-project API key to read pending fix tasks and move them across the board. Agent access is a paid capability (Solo Viber and up); the server answers 402 for a workspace on the free plan.

## Pricing

- Free: $0, 1 repository, 3 scans in total (a one-time grant, not a monthly allowance and not renewable), five-layer scan, release decision, findings and fix board in the app. AI fix tasks, the launch report, and the MCP task board for coding agents are not included on Free.
- Solo Viber: $15/mo, 3 repositories, 20 scans/month, one member, AI fix tasks with acceptance criteria, launch report, rescan verification, posture analytics and trends, MCP task board. Integrations (Slack, Linear, Jira and more) are not shipped yet.
- Team - Vibecoding avengers: $29/mo, everything in Solo Viber plus unlimited repositories, 150 scans/month, up to 5 members, webhooks, API keys.
- Agencies (white-label reports, client management, per-client launch policies, SSO and audit logs) are served on a custom plan through sales, not self-serve.
- The workflow integrations are in development; Solo Viber and Team include them at no extra cost when they ship.
- No credit card is required to start; the 3 free scans do not renew.

## Data handling

- Repositories are accessed read-only for scanning.
- Your code is never used to train models.
- Scans run in isolated environments; you can delete your data at any time.

## Contact

- Sales and support: https://vibezero.io/contact (a form; there is no published email address). Messages reach the team inbox and are answered within two business days.