For apps built with Cursor, Claude Code, Lovable, Bolt, v0 and Replit

Security advisories for your app inventory

VibeBeacon watches the versions your project reports. If one has a security problem, you get an email telling you what to update and how to fix it.

Start free See a real app

First app free. No card. We never see your code.

This is what arrives

From VibeBeacon <alerts@vibebeacon.app>

To you@example.com

High severity: next 15.1.0 in My Coffee Shop POS

highexploited in the wildGHSA-f82v-jwr5-mffw

Your app My Coffee Shop POS runs next 15.1.0. A flaw in the middleware path lets a request skip authorisation checks. It is fixed in 15.2.3.

Run this

npm install next@15.2.3

Same major version, so no breaking changes are expected.

Illustrative alert. Delivery time varies with source refresh, matching and email delivery.

Open the alertSnooze for 7 daysEmail settingsUnsubscribe

How it works

1
Add your app
Run one command in your project folder, or paste one prompt into your AI tool.
2
We watch those versions
OSV, NVD, CISA and publisher sources are checked on scheduled refreshes. GitHub direct refresh needs a configured token; lifecycle and bulk checks run over longer cycles. Your last uploaded inventory is matched every 30 minutes on Free and Pro, 10 minutes on Team. Coverage and actual refresh times are public.
3
Review findings and available fixes
Alerts explain advisory matches and available fixes. Choose an agent review or authorise compatible fixes, then compare the next scan.

What we store, and what we never see

If our database leaked tomorrow, an attacker would learn that an email address runs Next.js 15.1 on Vercel. That is the whole design.

We store

Package names and reported versions, with direct, development and resolution flags
The ecosystem for each package, such as npm or PyPI
Runtime and framework versions, such as Node 22.11.0 and Next 15.1.0
Hosting provider names, such as Vercel or Fly
Service names, such as Stripe or Supabase
Your email address and app identity, optional groups and tags
Scan date, generator version, tool names and workspace counts

We never see

Your source code, not one line of it
Your .env files. The CLI refuses to open them
Application secrets, passwords or connection strings in scan payloads
File paths, repo URLs or database names
Your customers, your data or your traffic
Access to your GitHub, your host or your database

The privacy page shows the exact JSON we receive, field by field. How we protect you covers encryption, sign-in and infrastructure.

I'm a vibe coder like you, with several apps in production. I use Dependabot too, but I needed one page across everything I run, and an email only when a version I actually use has a hole. That is why I built VibeBeacon. Read why I built it.

Three ways to add an app

All three produce the same file, so use whichever your tool supports.

Run this in your project folder.

bash

npx vibebeacon@latest scan --upload

CLI reference

CLI

Run this in your project folder.

bash

npx vibebeacon@latest scan --upload

CLI reference

Prompt

Paste this into Cursor or Claude Code. The docs have a no-shell version for Lovable, Bolt and v0.

prompt

Scan this project and upload the inventory to VibeBeacon.

I authorise sending the documented scan JSON to https://vibebeacon.app/api/v1/manifests using the credential already configured for VibeBeacon. Payload: schema/generator version, scan date, app identity and optional group/tags, package names, versions, ecosystems, direct/dev/resolved flags, runtimes, frameworks, service/hosting/tool names and workspace counts. No source code, file paths, dependency trees, environment values or credentials in the payload. Do not print or inspect the credential. Do not use an alternative destination without my approval.

Run npx vibebeacon@latest scan --upload --api https://vibebeacon.app from the project root.
If no credential is configured, ask me to run npx vibebeacon@latest login. Never inspect or print it.
Do not read .env files, change dependencies or upload source code. Preserve app identity and scan scope.
Report inventory status, changed alert IDs and reasons, score changes and any pending processing.
Missing packages are not verified fixes. If the command fails, report its safe error and stop.

Both prompt variants

MCP

Add the server to your editor and ask it to scan the project. It can read back your open alerts too.

.mcp.json

{
  "mcpServers": {
    "vibebeacon": {
      "command": "npx",
      "args": ["-y", "vibebeacon-mcp"]
    }
  }
}

Config for Claude Code, Cursor, Windsurf and Claude Desktop

Pricing

Free

One app. No card needed, no time limit

One app, watched the same way as a paid one
Instant email on high and critical advisories
Daily or weekly digest, your choice
Per-app severity thresholds
Full alert history
API, MCP and GitHub Action access

Start free

Pro

Most people

USD $2

per app per month, or USD $19.20 per app per year

Everything in Free, plus

As many apps as you want, each watched the same way
Your first app stays free, so five apps costs USD $8
Stack Insights, which is closed on the free plan
Add or archive an app any time; billable slots have a 30-day hold
Monthly or yearly, switched from the billing page

One subscription with a count on it. Cancel any time and your apps pause rather than delete.

Start free, add apps later

Team

USD $5

per app per month, or USD $48 per app per year

Everything in Pro, plus

Slack, Discord and webhook alerts
Checks every 10 minutes instead of every 30
Audit export and a monthly PDF report
Email the founder, usually within one business day

Every app is billed on Team. There is no free first app.

Start free, move to Team later

Full pricing has the plan comparison, the cost calculator and the billing rules.

Questions

What exactly do you store about my app?

Package names, versions, ecosystems, dependency flags, runtimes, frameworks, hosting, service and tool names, scan date, generator version, app identity, optional groups/tags and workspace counts. No code, no paths, no env values, no keys, no repo URLs. The CLI refuses to read .env files, and the server rejects any manifest that contains something secret-shaped.

Why not just use Dependabot or npm audit?

You should still use them. Dependabot opens a pull request in one GitHub repo. npm audit checks the lockfile in the folder you are in. VibeBeacon watches runtimes, hosts and services as well as packages, across every app, without repo access. The comparison page has the longer version.

What if I cannot run a shell, like on Lovable, v0 or Bolt?

Use the no-shell prompt. It asks your AI tool to write the JSON from package.json and the lockfile. Versions read from a range are less precise, so we mark those entries unresolved and match conservatively.

How much email will I get?

By default, only high and critical problems that match a reported version trigger an instant email. Everything else goes into a daily digest, and news items are batched weekly. You can raise or lower the threshold per app, and dev-only dependencies are suppressed by default.

Why should I trust you?

The privacy page shows the exact JSON we receive. The CLI is open source, so you can read what it collects before you run it. Your dashboard lists everything we hold on each app, with a button that deletes it. We never ask for access to your code, your host or your database.

Add your first app in about two minutes

If nothing in your stack is affected, you hear nothing until something is.