You built it, maybe with AI tools, and people already pay for it. Now it has to hold up: more customers, more data, more people looking closely. vibeship shows you what stands between your product and production: what's ready, what blocks it, and what to do next, in order of importance, in plain English.
Joins quick checks run so far
With ten customers, a slow page or a missing privacy policy is an awkward email. With a thousand, it is lost sales, a data breach, or a buyer who walks away. These are the areas that change, and how much of each we check today.
Your padlock and browser safety settings, private files left public, secret keys in the code you send to visitors, a real break-in attempt, how safe your sign-in is, and whether one customer can reach another's data.
With read access you grant on GitHub: passwords and keys left in your code, including old versions, weaknesses in the code you wrote, and known holes in the code you borrowed.
Privacy, terms, contact and about pages, protection against fake emails sent in your name, how you show up on Google and when shared, and whether your site shows its buyers what they look for.
Whether a stranger can read your database, what your site shares about visitors, and whether a privacy policy is there. We don't review your contracts or what you do with the data: that is a question for a lawyer.
How fast each page loads on phones and computers, for one visitor. We don't yet test how your site behaves with many people on it at once.
Whether passwords can be guessed at will, how your padlock is set up, and leftover developer code that should never reach customers. We don't watch whether your site stays up.
No scan from outside can tell whether you have one, or whether it restores. Ask yourself when you last tried.
Where errors go when something breaks at 3am, and whether anyone finds out. We'll tell you when we can check this; until then, it's on your own list.
Each step looks further in than the one before. Start free from the outside; go behind your login and into your code when you're ready.
Paste a URL. Free, no signup, about a minute. Sixteen things a visitor can see from outside: speed, safety, getting found and trust. You get a grade, a score out of 100 and how many things in each area need work. It's the first look, not the whole picture: it tells you where the problems are, not yet what each one is.
free · anyone · 60 secondsFree with an account. Sixteen parts, about half an hour: a real break-in attempt on every public page, the weaknesses everyone already knows about, your sign-in, your padlock, and more. You see the score and where the problems sit; the full report is €19.99 once, or included with a subscription.
free with an account · 30 minutesWith a subscription, the deep test signs in to your site as one of your users and tries again: whether one customer can reach another's data, and whether your sign-in stays safe once someone is in.
subscriptionInstall our GitHub app on the repositories you pick, private ones included, with read-only access you can take back on GitHub at any time. We look for keys left in the code and its history, weaknesses in what you wrote, and known holes in what you borrowed.
subscription · your choice on GitHubRescan as often as you like. Every run is kept, a graph shows whether things are getting better, and you can ask us about any finding and read our answer where you found it.
subscriptionvibeship gives best-effort advice from what our checks can reach. It is not a guarantee that your site is secure, and it does not replace a professional security firm or a formal audit. It tells you what to fix first, so the step to production costs less, and so the money you later spend on experts goes further.
The quick check looks at your site the way a visitor would and shows you the score and where the problems are. The extensive scan attacks it properly and shows you the same. A subscription tells you what each problem is and how to fix it, and adds your login and your code: the parts of the road nobody can see from outside.
| What gets checked |
Quick check
Anyone, no signup
About 60 seconds
Free the score, the grade and how many things per area — not what each one is |
Extensive scan
The site owner, with a free account
About half an hour
Free the score and where the problems sit |
Full report
Every finding, where it sits, how to fix it
Subscription: €9.99 a month per site, three months minimum or €19.99 once for one report and one extensive scan |
|---|---|---|---|
| Seen from outsideWhat any visitor could see | |||
| Secure connection and browser safety settings | Included | Included | Included |
| Loading speed and phone layout | Includedhome page | Includedevery page | Includedevery page |
| How you show up on Google and social | Includedhome page | Includedevery page | Includedevery page |
| Private files left public, leftover developer code | Included | Included | Included |
| Protection against fake emails, privacy and terms pages | Included | Included | Included |
| Break-in test on your forms and links | PartlyPublic pages only | Includedevery public page | Includedsigned in, with a subscription |
| Whether everyone can use your site, and what it shares about visitors | Not included | Included | Included |
| Known weaknesses in the software you use | Not included | Included | Included |
| Behind your loginWhat only a signed-in owner can test | |||
| A real break-in attempt, signed in to your site | Not included | Not included | Includedwith a subscription |
| The service behind your site | Not included | Partlywhat a visitor can reach | Includedwith a subscription |
| Whether one user can reach another's data | Not included | Not included | Includedwith a subscription |
| Whether passwords can be guessed at will, and how safe your sign-in is | Not included | Included | Included |
| In your codeWhat nobody can see from the outside | |||
| Passwords and keys left in your code, including old versions | Not included | Not included | Includedwith a subscription |
| Weaknesses in the code you wrote | Not included | Not included | Includedwith a subscription |
| Known holes in the code you borrowed | Not included | Not included | Includedwith a subscription |
| How you see itWhat you get back | |||
| A letter grade and a score out of 100 | Included | Included | Included |
| How many things each part of the test found | Included | Included | Included |
| What each problem is and how to fix it, with a brief for your coding assistant | Not includedscore and counts only | Not included | Included |
| A map of your app showing where every finding lands | Not included | Partlythe shape, not the detail | Included |
| Who your site is for, and whether it shows it | Not included | Partlythe verdict only | Included |
| Every past run kept, so you can see what got better | Not included | Not includedone run per site | Includedwith a subscription |
Included Included Partly Partly Not included Not included Everything the quick check finds, the extensive scan finds too. Both show you the score and where the problems are; a subscription tells you what each thing is, how to fix it, and keeps going behind your login and into your code.
The quick check and the extensive scan cost nothing and show you the score. A subscription walks the whole road with you for a product you keep shipping; one report can be bought on its own.
For: "People pay for this. I want to know what blocks production, what to fix first, and what's behind my login and in my code."
three months minimum, then cancel any time · add another site with another subscription
Not useful? Tell us within 7 days and we refund the first payment.
By subscribing you agree to our terms, including that scans are best effort and don't replace a security firm.
Subscribe → Watch the demo firstFor: "I ran a check and I want to know what stands in the way, once."
bought on a quick check: that check's full report, plus one extensive scan of the site from the outside, its report included · once only: no rescans, no graph over time · paid from the report itself
vibeship.eu checks a website or web app on its way from first paying users to production. It shows what is already in place, what blocks production and what to do next, in order of importance and in plain English. It is built for founders who made their product themselves, often with AI coding tools, and who are not security specialists.
Yes, it is free, with no signup, and takes about a minute. It looks at sixteen things a visitor can see from outside: loading speed on phones and computers, the secure connection, browser safety settings, private files left public, secret keys in the code you send to visitors, the PHP break-in flaw being used against sites right now, protection against fake emails, how your pages show up on Google and when shared, your privacy, terms and contact pages, and a careful break-in test on your forms and links. You get a grade, a score out of 100 and how many things need work in each area.
The quick check does what a careful visitor could: it loads your pages, asks for a few files that should not be public and sends harmless test input to your forms and links. None of it is designed to change or delete anything. The extensive scan goes further, so it asks you to confirm that you may have the site tested before it starts.
The quick check and the extensive scan from outside are free and show the score and where the problems are. The full report of one check is €19.99 once and includes one extensive scan of the same site. A subscription is €9.99 a month per site, three months minimum, then cancel any time: every finding explained with fix steps, scans as often as you like, and tests behind your login and in your code. Not useful? Tell us within 7 days and we refund the first payment.
No. Our scans are best effort: they can miss a weakness or flag one that isn't there. A grade is advice, not a guarantee, and it does not replace a professional security firm. Your site's safety stays your responsibility.
Yes, with a subscription. You install our GitHub app on the repositories you pick, private ones included, with read-only access you can take back on GitHub at any time. We look for passwords and keys left in the code and its history, weaknesses in the code you wrote, and known holes in the code you borrowed.
No. Every finding is written so you can read it out loud and know what to do, and each fix comes with a brief you can paste into your coding assistant.
vibeship.eu is built and run by a small team in Heidelberg, Germany, and its servers are in Germany too. You can reach the people who built the checks at support@vibeship.eu.
Tell us what you've built, how many people pay for it, and what worries you about growing. We reply within one business day.
support@vibeship.eu or Run the quick check first