Security for AI-built apps

Your vibe-coded app,
locked down.

One npm install. One line of middleware. VybSec handles rate limiting, bot blocking, injection detection, and security headers — automatically.

middleware.tsTypeScript
// Drop into any Next.js app
import { VybSec } from 'VybSec'

export default VybSec({
  apiKey: process.env.VYBSEC_KEY,
  rateLimit: '100/min',
  blockBots: true
})
✓ Hobby needs no card  ·  ✓ 50K events/mo free  ·  ✓ Free vulnerability scanner
Not sure yet?
Recent threats · livestreaming
INJECTION/api/auth · 185.220.101.42now
BOT/wp-admin · 45.155.205.1082s
RATE LIMIT/api/search · 203.0.113.845s
BOT/.env · 198.51.100.228s
INJECTION/api/users · 139.162.71.512s
Blocked / 24h
1,284
Bots
847
Latency added
0.7ms
Status
All clear
Works with the stack you're already using
Data encrypted at rest No ads or trackers Source available
New · free vulnerability scanner, no sign-up

Find vulnerabilities before attackers do.

Most vibe-coded app breaches come from vulnerabilities inside the app itself. One command scans your codebase and database in seconds, locally. Nothing is uploaded.

terminal
$ npx vybsec audit

Live database scans: Supabase · Firebase · PocketBase · Appwrite
Leaked-credential scans: PostgreSQL · MySQL · MongoDB · Redis

Exposed databases
Tables and collections readable without login: missing RLS or open security rules
Leaked API keys & secrets
API keys, database passwords and .env files exposed in code, git or the browser bundle
Unauthenticated API routes
POST, PUT and DELETE endpoints that write data with no auth check
Unverified payment webhooks
Stripe, Paddle and Flutterwave webhooks missing signature or amount verification
Privilege escalation
Plans or roles stored in user_metadata, so users can upgrade themselves
5
Threat categories blocked
0
Network calls on the request path
1 file
To deploy full protection
50K
Events/mo free on Hobby