Halation 0.1.5-beta

A result you can post, and one decision about what leaves your machine instead of four buttons that looked alike.

New

• A scorecard image, a fourth export. A 1200x630 PNG for a readme or a post, carrying the score, how much of the application could be read, and what was found.
• Scan a file and its SHA-256 goes on the card, so anyone can rescan that file and check they get the same answer. The card names the version that produced it, because rules are added between releases.
• Coverage sits beside the score at the same size. 99 out of 100 against a tenth of an application is not the claim that number makes on its own.
• A card from a folder scan carries no hash and says why. Scanning a folder digests file names and sizes rather than your code, and two different folders can share one. Scan the built file if you want a card somebody else can check.

Changed

• One Export report button on the results screen, in place of a button per format. It asks which of the four you want, says what each is for, and marks whether it carries your own code.

Known limits

• Still unsigned, so Windows will warn the first time you run it.

---

Requires Windows 10 or 11, 64-bit. One self-contained file, with no runtime to install.

• Halation.exe is the application.
• Halation-v0.1.5-beta-win-x64.zip is the same build, zipped.

Halation 0.1.4-beta

VibeCheck is now Halation. The old name collided with several unrelated products, and nothing about what the tool does has changed.

Changed

• The application is called Halation, and the executable is Halation.exe. Shortcuts pointing at VibeCheck.exe will not find it.
• Your settings come with you. The audience choice, window position, update preference and, if you set them, your encrypted API key and endpoint are carried over the first time this build runs. They are copied rather than moved, so the old folder is left exactly as it was and the previous build still works if you go back to it.
• Settings now live in %LOCALAPPDATA%\Halation.
• A new mark, an H whose crossbar bleeds past the stems.

Fixed

• The version sent to OSV when checking your dependencies was hardcoded, and had reported 0.1 since the first release whatever build was actually running.

Known limits

• Still unsigned, so Windows will warn the first time you run it.
• The old project page at kailoren.github.io/VibeCheck is gone rather than redirected. The site is now at kailoren.github.io/Halation.

---

Requires Windows 10 or 11. One self-contained file, with no runtime to install.

• Halation.exe is the application.
• Halation-v0.1.4-beta-win-x64.zip is the same build, zipped.

v0.1.3-beta

The score now comes from the pattern checks alone, so the same application scores the same for everybody.

New

• A dialog before each scan asks what kind of application this is: cleaner, password manager, wallet, and so on. Optional, and it excuses nothing. It changes how each question about what the app can do is worded.
• Scanning waits for you. Dropping a file no longer starts it straight away, so your deep pass settings apply to the scan in front of you.
• Browsing is two buttons, Choose a file and Choose a folder, instead of a folder dialog you had to cancel to reach the other one.
• Confirm your app has a reason for something and you get advice on doing it safely, rather than being told not to run it.
• Run the deep pass over source and it picks up the reasons your own comments give, so you confirm your note instead of retyping it.

Changed

• The AI pass no longer moves the score. It is still reported in full, and a result still cannot be called clean while its suggestions sit underneath.
• Suggested model download sizes are shown beside each model, and are now correct.
• The coverage note leads with the fact that every file was checked.
• Checks that do not apply to your code say so, and name the languages you wrote in.

Fixed

• A local model with too small a context was quietly dropping most of a large file and answering anyway. Those files are now reported as unread rather than trusted.

Known limits

• Point it at your source rather than your release build when you have both. Decompiling strips the comments the AI pass reads.
• Not code-signed yet, so Windows will warn on download.
• A small local model is not yet worth trusting for the deep pass.

---

Windows 10 or 11, 64-bit. One self-contained file, nothing to install.

VibeCheck.exe is the application. The zip is the same file with the readme and licence
alongside it.

v0.1.2-beta

A scanner that tells you where your code went, and lets you decide.

The deep pass is no longer tied to one vendor

The optional deep pass can now be answered by anything speaking the OpenAI chat-completions
shape: OpenAI, OpenRouter, Google Gemini, Groq, Together, DeepSeek and Mistral, or Ollama and
LM Studio running on your own machine. A local model is the one configuration where the files
never leave the computer at all.

• A Configure dialog with presets, because the hard part of this setting is remembering
  somebody else's URL. A pasted base URL is completed to the chat-completions path in the box
  itself, so what is on screen is what gets requested.
• Ollama and LM Studio are detected. VibeCheck asks them what models they have and lists
  them, so nothing has to be typed from memory.
• Your graphics card is read and the models are judged against it: fits, only just fits, or
  too big and will run on the processor. The figure is editable, because detection is wrong on
  any laptop with two adapters. No card is a supported answer, not a refusal.
• Source code only leaves the machine over TLS, with an explicit 1.2 floor, and the report
  states the version that was negotiated rather than the one that was configured. Loopback
  in the clear is allowed, being the normal shape for a local model.

Every claim about your code is derived, not asserted

• Each of the three routes explains itself on hover: where the code goes, what it costs, what it
  needs. Destination first, because two of them upload and one does not.
• A loopback address is no longer taken as proof of privacy. Ollama serves its cloud models
  from localhost:11434 and forwards them to ollama.com, so a -cloud model is now reported as
  the upload it is.
• A run against an endpoint VibeCheck did not choose no longer prints a dollar figure computed
  from Anthropic's price list. It reports tokens and declines to invent what they were worth.
• The API key dialog said a scan costs "a few cents". Forty files at Opus rates is dollars.

Also in this release

• Findings are weighed against what the application was said to be for, and the report says
  beside the score when a class of check could not run at all.
• Minified code no longer collapses to one finding per rule.
• The updater switches itself off in a packaged build, where it cannot replace the binary.

---

Windows 10 or 11, 64-bit. No installer and no runtime to fetch: one file, self-contained.

VibeCheck.exe is the application. The zip is the same file with the readme and licence
alongside it.

v0.1.0-beta

VibeCheck 0.1.0-beta

First build handed to testers. Drop an application in, and VibeCheck recovers what source it can, checks it, and reports what it found and what it could not reach.

This is a beta because nothing outside this machine has run it yet. The analysis, the interface and the optional deep pass are complete and tested; what is missing is other people's hardware, other people's applications, and a code signature.

What it does

• Recovers real source from shipped binaries. .NET executables and libraries are decompiled with ILSpy, single-file publishes are unpacked from memory, Electron apps are read out of their .asar, NSIS installers are opened and their payload handed to whichever of those understands it. Nothing is executed and nothing is written to disk.
• Around 40 checks across secrets, configuration, code safety, untrusted input and malicious behaviour, plus packaging checks and live dependency advisories from OSV.dev.
• Two reports, one scan. Pick whether you are the person shipping the application or the person deciding whether or not to run it. The severities differ because the risk genuinely differs: a committed API key is critical for the author and nothing at all for the reader.
• A coverage figure kept separate from the score, because a clean result at 12% coverage is a different claim from a clean result at 95%.
• An optional deep pass that reads the code and reasons about it, using either your own Anthropic API key or a Claude Code installation you already have. Off unless you turn it on.

What it will not do

It will not tell you an application is 100% safe. Static analysis can show that bad patterns are present; it cannot show that none are, and a deliberately malicious app reads cleaner than a sloppy honest one. So there is no "safe" verdict anywhere in the interface. There is a score, a coverage figure, and an explicit list of what could not be checked.

An explicit do not install comes only from a handful of high-confidence rules that match specific artefacts of credential theft, never from a low score.

Known limits in this build

• Unsigned. Windows SmartScreen will warn on download. Signing comes after this beta.
• Native applications cannot be read. No decompiler produces analysable source from one, so they report zero coverage and say so rather than reporting nothing found.
• Obfuscated applications get no score, deliberately. The code comes back as a.b(c), which is text rather than something a check can read, so it counts as unexamined.
• Dependency checks need a network. Without one they do not run, and the report says so.
• Inno Setup installers, and NSIS installers using solid compression, cannot be unpacked yet.
• Scanning a security scanner produces a false "do not install", including this one scanning itself: the rules that look for wallet-file paths match their own pattern definitions in the decompiled source. Known and accepted rather than papered over, because the guard that would fix it would also suppress a real credential stealer.

What to try, and what would help most

Run it against something you downloaded and something you wrote. The most useful thing you can send back is a report that is wrong: a finding that is not real, or a clean result on something that should not have been clean. Coverage figures that look implausible are worth reporting too.

Export a report as Markdown or JSON before sending it. Neither contains your code: findings quote at most a single redacted line of evidence.

Requirements

Windows 10 or 11, 64-bit. Nothing to install and no runtime to add: the download is one self-contained executable. Extract the zip and run VibeCheck.exe.

Settings live in %LOCALAPPDATA%\VibeCheck and are a handful of small files. Delete that folder to reset everything.