You take the shot.
We read the green.
VibeCaddie audits the code you did not fully write. Point it at a repository, run it, and get a ranked list of what to fix before it bites you.
You built it in an afternoon. Nobody has checked it.
AI tools made it easy to produce working code fast. They did not make it easy to know whether that code is safe to ship. An auth flow can work perfectly and still trust client input, leak a session, or log a secret.
The usual safety net is a second pair of eyes. Most people shipping AI-assisted code do not have one, and the scanners built for teams assume a security engineer is standing by to triage the noise.
Bad code usually works. That is the problem.
How it works
Point it at a repo
Read-only access to the repositories you want watched. Nothing to configure.
The agent picks its skills
It reads the repo, works out what kind of codebase it is, and loads the review skills that matter for it.
You get a report
Findings ranked by severity, with exact files and lines, a plain explanation, and a suggested fix.
The report
Five real problems beat fifty warnings.
Every finding says what is wrong, why it matters, and what to do. Clean means nothing we looked for turned up. It does not mean nothing is there.
Sample · illustrative, no audit has run
Session token accepted from query string
Stripe webhook signature not verified
Raw error object returned to client
User email logged at info level
lodash 4.17.15 has a known prototype pollution issue
Skills
The caddie picks the club.
You never configure these. The agent reads the repository, works out what it is, and loads the review skills that apply. A Stripe integration gets the webhook skill. A CLI does not.
The loop
A loop, not a gate.
Run the audit. Fix what it found. Run it again. Each run costs the same 12 credits, so you always know what the next pass will cost before you start it.
Repeat until the report comes back clean, or until you decide the rest can wait. That call is yours.
Credits
Prepaid. One run is 12 credits.
No subscription. Credits do not expire. The price of a run is on the button before you press it.
Planned pricing · nothing is on sale yet
Enough to audit one project, fix it, and run it again a few times.
A run before every release for the better part of a year.
Several repositories, or a small team running it on every branch.
Questions
The short answers.
Is this available yet?
No. The GitHub app is not built and not listed, no audit has ever run, and no credits can be bought. The site and the early-access list are the only things that exist.
Is it a replacement for a security review?
No. It is a second pair of eyes for people who do not have one. A clean report means nothing it looked for turned up, which is not the same as nothing being there.
Does it write code or open pull requests?
No. It reads, it reports, and it suggests. Every change is yours to make, which is also why read-only access is enough.
What does a run cost?
A run is 12 credits, whatever the size of the repository. Credit packs are planned at $15, $60 and $180, which works out between $1.80 and $3.00 a run. Nothing is on sale yet.
Why credits instead of a subscription?
Because a review is a thing you do occasionally, not continuously. A subscription would charge you in the months you shipped nothing.
Which languages does it cover?
The review skills are written against patterns rather than syntax, so the intent is broad coverage. Exactly what is supported at launch will be listed here before launch, not promised now.
Does my code train a model?
No. See the privacy page, which says what is stored, what is not, and what the model provider is allowed to do with it.
Did you run it through a caddie?
The GitHub app is not built yet. Nothing here can be installed or bought. Leave an address and we will write when there is something to try.