Live now. Sign up free, paste your app’s address, and this works from your dashboard. What is live today lists what is still to come.
A signal is one of the ways VibeLock checks a control. Each one sees something the others cannot, and the badge needs checking from the outside and the inside. Connect one to see your dashboard. Connections are never gated by plan, including Free.
The four signals
- Live URL
- The outside scan of your running app: TLS, DNS, security headers, exposed files and pages, cookies, and whether the app offers external sign-in or ships an MCP server. Safe mode only. Needs ownership proof for anything beyond the passive preview.
- Repository host
- Your repository, through a read-only connection. It reads the host’s security alerts (dependency and secret alerts) and, once switched on, VibeLock reading the code itself at one commit. See Repository read.
- Coding tool
- The VibeLock MCP server in your coding tool. Your coding tool checks the code on your machine and reports results. See The VibeLock MCP server.
- Cross-check
- Compares what your published documents say, such as your privacy policy, with what the other signals verified. A policy that claims a control you do not run is a finding.
Which connection to choose
- You build with a coding tool
- Connect the MCP server, and connect your repository host as well if you can. Coding tool passes count only once corroborated, and the repository connection is the quickest way to corroborate them.
- You build in an app builder
- Connect the repository your builder syncs to. That is your code connection.
- Everyone
- Prove the app is yours. The badge needs an outside scan on a proved address plus a code connection.
An optional build check
Teams who prefer it can add a pinned VibeLock workflow to their repository’s own build. Its results count only when the host’s signed identity token proves the pinned workflow ran on a hosted runner at the head of the default branch. It never runs your code, and only verdicts, rule ids, paths and line numbers come back. It is an optional second route; the repository read is the primary one.
Tokens
Connection tokens are per app, rate limited, and revocable at any time. A revoked token stops working at once.
If a connection drops
Your dashboard shows a "disconnected since" banner and rescans through that connection are blocked. The connection is held for 14 days; after that, if the badge depended on it, the badge shows your last verified date. Reconnecting and a verified scan bring Verified back.