If nothing here helps, email hello@vibelock.ai.
The checklist and the Security OS
- The checklist email did not arrive
- The download starts on the page, so you already have the PDF. Check spam or promotions for the copy, then email us if it is not there.
- I cannot open the Security OS
- It is a Notion template. Open the link in your purchase receipt while signed in to Notion and duplicate the template into your own workspace.
- I joined the waitlist before sign-up opened
- No harm done. Sign-up is open now: sign up free with the same email and paste your app’s address.
Ownership checks
- The file check fails
- Open https://your-app/.well-known/vibelock-verify in a private window. It must show only the token as plain text. Many single-page apps answer every path with the home page; if yours does, use the meta tag instead.
- The tag check fails
- The tag must be in the HTML the server sends, not added later by JavaScript. View the page source, not the inspector, to confirm it is there.
- No DNS option
- Your app is on a builder’s shared subdomain, whose DNS you do not control. Use the file or the tag.
- It worked, then stopped
- Proof is per host. A redeploy that dropped the file, or a move between www and no www, counts as lost proof. Put it back within 14 days.
MCP scans
- The batch was rejected
- Something in a note or a path looked like code or a secret value. VibeLock lists each problem; ask your tool to fix those items and submit again. The scan is not used up.
- The commit moved
- You committed during the scan. Start a new scan at the new commit.
- The scan expired
- A scan must be submitted within two hours of starting. Start another.
- Too many scans
- A scan can be started six times an hour per app. Wait and try again.
A pass is not counting
A pass from your coding tool counts only when it is corroborated: a second scan of the same commit, with no uncommitted changes and at least an hour later, that agrees, or a repository check. Commit your work, wait an hour, and scan again, or connect your repository host.
The badge shows Last verified
Open Overview. It lists the five criteria, marks the one that does not hold, and says what fixes it: an open critical, a high past its deadline, coverage under 80 percent, no full scan in 30 days, or a missing connection.
A finding will not close
Findings close only on evidence. Click Verify fix to rescan that check. A Likely critical clears with a confirming rescan or VibeLock review. You cannot dismiss it.