VibeLockVibeLock

Free to start. No sign-up for the first check.

Prove your app is secure. Keep the proof live.

VibeLock verifies the security of apps built with AI coding tools, confirms every fix by rescan, and publishes a trust page your customers and investors can check for themselves.

Passive check, no sign-up. We only look at what any visitor sees.

See an example trust page
  • Verified only while the facts hold
  • Fixes confirmed by rescan
  • Never writes to your code

Built for the moment someone asks.

Customers, procurement teams and investors all ask the same question. VibeLock gives you an answer they can verify.

  • Clear security reviews faster

    Send your trust page instead of a long email thread. Reviewers see the controls that were verified, how each was checked, and when.

  • Answer “is it secure?” with a link

    The live verification link shows the state of your app today. A screenshot shows one moment. The link shows now.

  • Shorten diligence

    Investors and buyers see dated evidence from scans of your live app and your code, not a self-assessment.

What your buyer sees.

One public page that shows what was verified, how and when. Share it in a security review, a sales thread or a data room.

Verified
Shown only while all five criteria hold today.
Last verified, with the date
Shown when one stops holding. Nothing is taken down.
Verified controls only
Each with the method that checked it and how recently.
Never your findings
Failures, counts and commits stay on your private dashboard.
vibelock.ai/trust/ledgerlyExample

Ledgerly

ledgerly.example

Invoicing for small studios.

VibeLock VerifiedLast verified scan 30 Oct 2026
See the live verification

What Verified means

An app is Verified when all five of these hold today.

  • VibeLock reached at least 80% of the checks that apply to this app.
  • No critical finding is open.
  • No high finding is past its deadline.
  • A full scan ran in the last 30 days.
  • Ownership of the domain is proved and the app code is connected.

What was checked

Each control was checked by the method shown, on the live app, its repository or its published documents.

Authentication & sessions

  • Session cookies carry the Secure attributeChecked from outside, today.
  • Every protected route verifies the session on the server, never client-side onlyChecked in the repository code, this week.

Access control

  • Every object access is ownership-checked on the server (no IDOR)Checked in the repository code, this week.

Secrets & cryptography

  • No secrets committed to the repository, now or anywhere in historyChecked with the repository host, today.
  • Server-only secrets never reach the browser bundleChecked from outside, today.

Encryption in transit

  • All traffic is HTTPS; plain HTTP redirects to HTTPSChecked from outside, today.
  • HSTS is set with a max-age of at least one yearChecked from outside, today.

Questions buyers ask

VibeLock writes these questions. An answer appears only when verified evidence backs it.

Is all traffic encrypted?
Yes. All traffic uses HTTPS with modern TLS, and browsers are told to keep using it. Checked from outside, this week.
Are secrets kept out of the code and the browser?
Yes. No secrets were found in the repository or in what the browser receives. Checked from outside, this week.
Are sign-in sessions protected?
Yes. Session cookies are secure, and protected routes check the session on the server. Checked from outside, this week.

Need more detail?

Ask Ledgerly for security information. They can share a private detailed link.

VibeLock verifies application controls and helps you organise your security program. It is not an audit or a certification, does not replace a qualified auditor or lawyer, and is not legal advice.

VibeLock verifies application controls. It is not an audit or a certification.

VibeLockCheck your own app
Example only. A fictional app with sample data.

From first check to public proof.

Four steps, repeated on a schedule, so the proof stays current.

  1. 01

    Check

    VibeLock checks your live app from outside and your code from inside, through your coding tool or a read-only repository connection.

  2. 02

    Fix

    Every finding comes with a severity, a deadline and a fix prompt you paste into your own AI coding tool.

  3. 03

    Verify by rescan

    A rescan confirms each fix. Nothing is marked fixed on anyone’s word, including yours.

  4. 04

    Publish the proof

    When all five criteria hold, your trust page and badge show Verified, backed by a live verification link.

Read how it works in the docs

Checked against published standards.

VibeLock writes no requirement of its own. The checks cite the published requirements behind them, so a reviewer can trace each verified control to its source.

Standards

  • OWASP ASVS 5.0

    Application Security Verification Standard

  • OWASP AISVS 1.0

    AI Security Verification Standard, for AI features and agents

  • GDPR

    Personal data the app collects, exposes and keeps

  • EU AI Act

    Telling people when they are dealing with AI

  • ePrivacy Directive, Article 5(3)

    Cookies and storage set before consent

What is checked

  • Sign-in and sessions
  • Access to each user’s own data
  • Secrets in code and in the browser
  • Encryption in transit
  • API routes and web services
  • Input handling and injection
  • Files and uploads
  • Errors and configuration
  • Dependencies
  • AI features, agents and retrieval
  • Privacy and published policies

How it is checked

  • Live URL

    Your app as any visitor reaches it.

  • Repository host

    Your repository, read only. Code is read at one commit and never stored.

  • Coding tool

    Checks run in your own coding tool. Your code never leaves your machine.

  • Cross-check

    What your published documents say, against what the app does.

Clear limits, by design.

Proof is only worth sharing if it cannot be gamed. These rules hold for every app.

  • Never writes to your code

    VibeLock advises. Your own coding tool applies every fix, and you stay in control of what ships.

  • No self-attestation

    Nobody can dismiss a finding or mark it fixed. Fixed means a rescan confirmed it.

  • No score

    A single number hides what matters. You see which criteria hold, open findings by severity, and their deadlines.

  • Not an audit or a certification

    VibeLock verifies application controls with dated evidence. It works beside your auditor, never in place of one.

  • Only with permission

    Beyond the passive first check, VibeLock scans only apps whose owners have proved they own them.

  • Your code is never stored

    Code is read at one commit by an isolated scanner, then discarded. Only results come back.

Start free. Publish proof when you need it.

Free is open today. Paid plans are not open yet.

Billing period

  • Free

    See where you stand.

    $0

    • Passive preview of your live app
    • One verified scan
    • Dashboard frozen at that scan
    • No rescans, badge or trust page
    Check my app

  • Founder

    Not open yet

    Answer "are you secure?" with a link.

    $99

    a month, or $948 a year billed annually ($79 a month)

    • Trust page and Verified badge
    • Paste-in fix prompts
    • Rescans verify every fix
    • Weekly scheduled rescans

    Paid plans are not open yet. Start on Free today.

  • Team

    Coming later

    Several apps, several people.

    $299

    a month, or $2,988 a year billed annually ($249 a month)

    Everything in Founder, plus:

    • Up to 5 apps and teammates
    • Roles for each teammate
    • Questionnaire assistant
    • Daily scheduled rescans

  • Enterprise

    For procurement.

    From$999

    a month, billed annually, from $11,988 a year

    • SSO, SCIM and audit log
    • Evidence packs
    • MSA, DPA and named support
    • Built with its first customer
    Talk to us

Prices in US dollars, excluding tax. Paid plans renew automatically until you cancel, and you can cancel online at any time. Downgrading never deletes your data. Refund Policy

Compare every plan

Questions, answered.

Something else on your mind? hello@vibelock.ai

Read the docsSee all questions

What does a buyer see on my trust page?
Your badge and the date of your last verified scan, the controls that were verified with how and when each was checked, answers to common security questions drawn only from verified evidence, and any policies you publish. Never your failures, findings, counts or code.
How does the badge stay honest?
It reads Verified only while all five criteria hold: coverage of at least 80%, no open critical findings, no high findings past their deadline, a verified scan in the last 30 days, and an outside scan of an address you proved you own plus a code connection. If one stops holding, the badge shows the date you were last verified instead. The next verified scan brings Verified back.
Is VibeLock an audit or a certification?
No. VibeLock verifies application controls with dated scan evidence, and its checks cite the published standards behind them. It does not assess your organisation, and it does not replace an auditor. If a customer needs an audit report, you still need an auditor. VibeLock sits beside that work.
Is there a security score?
No. A single number hides what matters. You see the facts instead: which badge criteria hold, how much of your app was checked, and every open finding with its severity and deadline.
Does VibeLock change my code?
Never. Each finding comes with a fix prompt you paste into your own AI coding tool. You apply the fix, and a rescan confirms it.
What does the coding tool connection see?
The check runs inside your coding tool, on your machine, and your code never leaves it. VibeLock receives results only. A failure counts at once. A pass counts only when a second run on the same commit, or a check of the repository, backs it up.
Can I use VibeLock today?
Yes. Paste your app's address at the top of this page to see what any visitor can see, free and with no sign-up. Sign up free to keep the results and run one verified scan once you prove the app is yours. Paid plans, with the trust page and badge, are not open yet.

Be ready when they ask.

Start with a free check of your live app. No sign-up.

Passive check, no sign-up. We only look at what any visitor sees.

Get the free checklist