
What is analyzed
Code Analysis
Identifies insecure patterns directly in the code you wrote: injections, missing validations, sensitive data exposure, and other logic issues.
Dependency Review
Checks for known vulnerabilities in the libraries your project imports, including transitive dependencies.
Secret Detection
Searches for credentials, tokens, and API keys that may have been accidentally committed to the repository.
Runtime Execution
Evaluates risks that manifest at runtime — server configurations, security headers, and exposed attack surface.
The classification that changes everything
Most security tools dump all findings into a single list. The result: dozens of alerts, half of them from development tools that never go live — and you don’t know where to start. VibeScale classifies each finding into one of three categories:Authored — problems in your code
Authored — problems in your code
Inherited — third-party vulnerabilities
Inherited — third-party vulnerabilities
Flaws in libraries your project imports. Worth reviewing — especially critical ones — but rarely require immediate action, since they depend on a package update, not a change in your own code.
Noise — development tools
Noise — development tools
Findings from packages used only in development that never reach production. They do not affect your score. Hidden by default and can be shown when needed.
Next steps
Run a check
Learn how to start the scan and what to expect during analysis.
Read the report
Understand the grade, finding categories, and how to act on each one.
Score methodology
See exactly how we calculate your score from A to E.
