Vibefilo

Check the app.Watch your agent fix it.

Security and GDPR checks for vibe-coded apps. They run inside Claude Code, Cursor and Codex, so your code never leaves your machine.

Start freeSee how it connects
claude · ~/my-saas
> check this app with vibefilo before I launch
⏺ vibefilo - vibefilo_start_audit (MCP)(mode: "normal")
 ⎿ Normal check started · 50 credits · 150 left
⏺ Read supabase/migrations, app/api, lib, app/layout.tsx (41 files)
⏺ Found 3 issues worth fixing before launch:
  BLOCKER profiles table has RLS disabled
  HIGH     STRIPE_SECRET_KEY read from NEXT_PUBLIC_ env
  MEDIUM   Google Analytics loads before consent
> fix the blocker and the secret
⏺ Update(supabase/migrations/0007_profiles_rls.sql)
 ⎿ Added 6 lines: enable RLS, select and update own row
⏺ Update(lib/stripe.ts)
 ⎿ Moved key to server-only STRIPE_SECRET_KEY
⏺ Re-checked both. 2 verified fixed, 1 open. Synced to your dashboard.
Example: Claude Code runs a Vibefilo check, finds an RLS blocker, an exposed Stripe key and a consent issue, fixes two and verifies them.
my-saasNormal check · 50 credits
Checking your app0 verified fixed
  • Blockerprofiles table has RLS disabledsupabase/migrationsOpen
  • HighStripe secret in NEXT_PUBLIC_ envlib/stripe.ts:4Open
  • MediumAnalytics loads before consentapp/layout.tsx:31Open

Understands apps built with

  • Lovable
  • bolt.new
  • v0
  • Replit
  • Next.js
  • Vite
  • Supabase
  • Firebase
  • Stripe
  • Vercel
  • Netlify

AI builds the app in a weekend.It ships the same mistakes every time.

Vibe-coded apps work, and they repeat the same security and privacy gaps. Vibefilo finds each one, your agent fixes it, and a re-check proves it.

  • Blocker

    A Supabase table anyone can read

    supabase/migrations/0007_rls.sql
    create table profiles (id uuid primary key);
    +alter table profiles enable row level security;
    +create policy "own row" on profiles
    +  for select using (auth.uid() = id);
  • Blocker

    A live Stripe key in the browser bundle

    lib/stripe.ts
    -new Stripe(process.env.NEXT_PUBLIC_STRIPE_SECRET!)
    +import "server-only";
    +new Stripe(process.env.STRIPE_SECRET_KEY!)
  • High

    An API route that trusts the URL

    app/api/invoices/[id]/route.ts
    +const user = await getUser();
    +if (!user) return new Response(null, { status: 401 });
    const invoice = await db.invoice.find(id);
    +if (invoice?.userId !== user.id) return notFound();
  • High

    Analytics that load before consent

    app/layout.tsx
    -<Script src="https://googletagmanager.com/gtag/js" />
    +{consent.analytics ? (
    +  <Script src="https://googletagmanager.com/gtag/js" />
    +) : null}
  • Medium

    A privacy policy from a template

    app/privacy/page.mdx
    -We may share data with trusted third parties.
    +We use Supabase (EU region), Stripe and Resend.
    +Each one has a signed DPA.
  • Medium

    No way to delete an account

    app/settings/account/page.tsx
    <Section title="Your data">
    +  <ExportDataButton />
    +  <DeleteAccountButton />
    </Section>

Everything betweenthe check and the fix.

Runs in your agent

Install once. Claude Code, Cursor, Codex, Windsurf and VS Code all get the same checks.

Three depths

Lite for blockers after any change, Normal while you build, Full before you launch.

Lite15 credits
Normal50 credits
Full100 credits

Code stays local

Only the rule, file, line and a masked snippet reach Vibefilo. Secret values never leave.

sk_live_••••••••••••
lib/stripe.ts:4

Fixed means verified

A finding only closes after a re-check passes, so your score tells the truth.

BlockerVerified
HighOpen

One shared dashboard

Every run from every agent lands in the same project for your whole team.

8 open14 verified

Reports in your repo

Your agent saves a Markdown copy of each run in vibefilo-scans/, next to the code.

vibefilo-scans/2026-10-15-normal.md2026-10-12-lite.md

One MCP server.Every coding agent.

One command connects Claude Code, Cursor, Codex, Windsurf and VS Code. Sign in once with a device code in your browser.

  1. 1

    Install

    Run one command in your project. It finds your agents and connects them.

    $ npx @vibefilo/mcp init
  2. 2

    Approve

    Your agent shows a short code. Confirm it in the browser, no keys to paste.

  3. 3

    Ask

    Tell your agent to check the app with Vibefilo. It does the rest.

Prefer to add it by hand?
$ claude mcp add vibefilo -- npx -y @vibefilo/mcp

Run in your project folder.

vibefilo · mcp
$ npx @vibefilo/mcp init
✓ Detected Claude Code, Cursor, Codex
✓ Linked this folder to my-saas
 
› vibefilo_status
  Signed in · 200 credits
› vibefilo_estimate  mode: normal
  50 credits
› vibefilo_start_audit  mode: normal
  run started · 150 credits left
› vibefilo_submit_findings  3 findings
  synced · dashboard updated
Approve Claude Codevibefilo.dev/device

Approved. Back to your agent.

Pay per check.No subscription.

Every new organization gets 200 free credits, enough for a Full check and its fixes before launch. Your agent shows the cost before every check.

Lite

Blocker-level rules on current code and config. No live requests.

15credits

After any change, before a commit

Normal

Recommended

All security and privacy checks at code level, plus key accessibility rules.

50credits

Regular checks while you build

Full

Everything at full depth, git history, live checks, the Ready verdict and PDF report.

100credits

Before launch or a client handover

Need more? Top up anytime.

Credits last 12 months. Failed runs are refunded.

  • Starter$5500 credits
  • Builder$101,050 credits · +5%
  • Pro$252,750 credits · +10%
Start free

Questions,answered.

6 things people ask before their first check.

Check your appbefore your users do.

Start free
$ npx @vibefilo/mcp init