v0.1.0-beta

VibeCheck 0.1.0-beta

First build handed to testers. Drop an application in, and VibeCheck recovers what source it can, checks it, and reports what it found and what it could not reach.

This is a beta because nothing outside this machine has run it yet. The analysis, the interface and the optional deep pass are complete and tested; what is missing is other people's hardware, other people's applications, and a code signature.

What it does

• Recovers real source from shipped binaries. .NET executables and libraries are decompiled with ILSpy, single-file publishes are unpacked from memory, Electron apps are read out of their .asar, NSIS installers are opened and their payload handed to whichever of those understands it. Nothing is executed and nothing is written to disk.
• Around 40 checks across secrets, configuration, code safety, untrusted input and malicious behaviour, plus packaging checks and live dependency advisories from OSV.dev.
• Two reports, one scan. Pick whether you are the person shipping the application or the person deciding whether or not to run it. The severities differ because the risk genuinely differs: a committed API key is critical for the author and nothing at all for the reader.
• A coverage figure kept separate from the score, because a clean result at 12% coverage is a different claim from a clean result at 95%.
• An optional deep pass that reads the code and reasons about it, using either your own Anthropic API key or a Claude Code installation you already have. Off unless you turn it on.

What it will not do

It will not tell you an application is 100% safe. Static analysis can show that bad patterns are present; it cannot show that none are, and a deliberately malicious app reads cleaner than a sloppy honest one. So there is no "safe" verdict anywhere in the interface. There is a score, a coverage figure, and an explicit list of what could not be checked.

An explicit do not install comes only from a handful of high-confidence rules that match specific artefacts of credential theft, never from a low score.

Known limits in this build

• Unsigned. Windows SmartScreen will warn on download. Signing comes after this beta.
• Native applications cannot be read. No decompiler produces analysable source from one, so they report zero coverage and say so rather than reporting nothing found.
• Obfuscated applications get no score, deliberately. The code comes back as a.b(c), which is text rather than something a check can read, so it counts as unexamined.
• Dependency checks need a network. Without one they do not run, and the report says so.
• Inno Setup installers, and NSIS installers using solid compression, cannot be unpacked yet.
• Scanning a security scanner produces a false "do not install", including this one scanning itself: the rules that look for wallet-file paths match their own pattern definitions in the decompiled source. Known and accepted rather than papered over, because the guard that would fix it would also suppress a real credential stealer.

What to try, and what would help most

Run it against something you downloaded and something you wrote. The most useful thing you can send back is a report that is wrong: a finding that is not real, or a clean result on something that should not have been clean. Coverage figures that look implausible are worth reporting too.

Export a report as Markdown or JSON before sending it. Neither contains your code: findings quote at most a single redacted line of evidence.

Requirements

Windows 10 or 11, 64-bit. Nothing to install and no runtime to add: the download is one self-contained executable. Extract the zip and run VibeCheck.exe.

Settings live in %LOCALAPPDATA%\VibeCheck and are a handful of small files. Delete that folder to reset everything.