Terms & privacy

vibecheck is a self-scan tool: you point it at your own app and it shows you what a stranger can already see. It performs no attacks — no injection, no authentication bypass, no writes, and no attempt to reach anything private.

• ·The URL checks read only publicly-accessible content — the same pages, headers, and files any visitor, browser, or search crawler can already fetch.
• ·The database check runs entirely in your own browser, using the anon/public key your app already ships. It mirrors exactly what any anonymous visitor can read — a mirror, not an exploit. Your key and your data never reach our servers.
• ·A public GitHub repo is read from its public source; a mobile app you upload is unzipped and scanned in your browser and never leaves your device.

Only scan applications you own or are explicitly authorized to test. You are responsible for your use of vibecheck and for having the right to scan any target you enter. Do not use it to probe, attack, or gain unauthorized access to systems you do not control. It exists for checking your own apps and for legitimate, authorized security testing.

• ·We store nothing about your scan — not the URL you entered, not your keys, not the findings.
• ·The database probes run client-side, so your keys and data never touch our servers.
• ·We use privacy-friendly, cookieless analytics (Vercel Web Analytics) to count usage — page views, which scan modes are used, grade distributions. No cookies, no cross-site tracking, no personal data, no account.
• ·No signup. The only personal data we ever store is your email, and only if you volunteer it to join the optional monitoring waitlist — used solely to email you about that feature.

vibecheck is provided “as is”, without warranty of any kind. Its findings are observations from the outside — not a penetration test, and not security, legal, or compliance advice. A clean result does not guarantee your app is secure. Use your own judgment and, where it matters, a professional review.

vibecheck is free and open source (MIT) — you can read exactly what it does and self-host it: github.com/FedericoTs/vibecheck.

Built by Federico Sciuca. Questions: federicosciuca@droplab.io.