v1.1.1: --host local, and dev tooling isn't the running app

From the first /vibecheck:deploy run on a real app, a local-only Node.js demo. The raw preflight reported 6 high and 1 low, and all 7 had to be corrected by hand.

• --host local for apps that only run on this machine. Localhost URLs, loopback binds (127.0.0.1), localhost Origin guards and fixed ports are correct for that target, so they aren't flagged. Host-dashboard reminders are skipped, and the verdict says "READY (local only)".
• Dev tooling isn't the running app. Env vars and localhost URLs in scripts/, tools/ and seeds/ folders no longer count as production requirements.
• A new "Local (this machine only)" host checklist: start command, port conflicts, restarting to load new code, and zipping the app without dropping runtime files or including .vibecheck/.

Update: claude plugin update vibecheck (Claude Code) or npx skills add ribato22/vibecheck (other agents).

v1.1.0: /vibecheck:deploy, catch "works on my machine" before you deploy

New skill: /vibecheck:deploy, a pre-deploy check for "works on my machine, broken in production".

• Env vars the code uses that aren't set on the host (compare with your host's variable names via --host-env; values are never read), or that are missing from .env.example
• Hardcoded localhost URLs, and env var fallbacks to localhost
• Imports whose letter case only matches on Mac/Windows ('./button' vs Button.tsx), which break on Linux build servers
• Packages imported but not listed in package.json
• Servers on a fixed port or bound to 127.0.0.1 on Railway, Render, Fly, Heroku and Docker; missing start script
• SQLite and disk writes on serverless hosts, Prisma Client never generated, multiple lockfiles, Node version mismatches
• A host checklist: migrations, auth redirect URLs, live webhooks, rebuilding after public env changes, with per-host guides for Vercel, Netlify, Cloudflare, Railway, Render, Fly, Heroku and Docker

/vibecheck:fix now fixes VC-DEPLOY-* findings too.

Update: claude plugin update vibecheck (Claude Code) or npx skills add ribato22/vibecheck (other agents).

v1.0.4: private reports outside git, fixes stay in scope

From the first full check → fix → re-check cycle on a real app.

• Reports stay private outside git too. .vibecheck/.gitignore only protects git. The audit now checks how else the project leaves the machine (no git, zip or handoff archives, Docker COPY . ., public npm packages, upload scripts) and tells you where to exclude .vibecheck/. It offers the edit instead of making it.
• fix stays inside the finding. It asks before touching files the fix doesn't need (docs, build, QA or packaging scripts).
• fix doesn't restart your processes. It tells you which running servers still have the old code and that unsaved demo state may be lost.
• fix without git: if you'd rather not use git, it backs up each file to .vibecheck/backup-<finding-id>/ before editing.

Update: claude plugin update vibecheck (Claude Code) or npx skills add ribato22/vibecheck (other agents).

v1.0.3: skipped folders no longer hide code that ships

• Skipped folders no longer hide code that ships. A file under a test, backup or QA folder is checked like app code when app code imports it, directly or through other imports (import, export … from, import(), require(), including ./x.js → x.ts and folder index files). In a real audit, two OpenAPI helpers kept in qa-scripts/ were used at runtime and had been skipped.
• notes lists those files. Imports through path aliases (like @/) aren't followed yet, and the note says so.

Update: claude plugin update vibecheck (Claude Code) or npx skills add ribato22/vibecheck (other agents).

v1.0.2: agents see every match

• Agents see every match. --json now returns up to 200 matches per rule (was 25). In a real audit, the old limit was used up by one noisy folder and hid the app's own code.
• Overflow is reported per file, in notes and in a new hidden field ({ rule: { file: count } }), so the agent knows exactly which files still need a look. The text view for humans still shows 25 per rule.
• The audit skill tells the agent to check hidden files and skipped folders before calling a rule fully covered.

Update: claude plugin update vibecheck (Claude Code) or npx skills add ribato22/vibecheck (other agents).

v1.0.1: exposure-aware verdicts, fewer false positives

Fixes from the first real-world audit outside Claude Code (Codex, on a local Node.js app).

• Exposure-aware verdicts: the audit decides whether an app is public, internal or local and judges findings for that exposure. A local demo can get "🟢 GO (local only)", and the report lists what must change before exposing it more widely. When unclear, it assumes public.
• Fewer false positives: code patterns are skipped in backup, archive and QA folders (secrets are still scanned there, and skipped folders are listed).
• VC-INJ-EVAL no longer flags Playwright's page.$eval() / page.$$eval().
• No generic "possible hardcoded secret" guesses in test files; real key formats still count.

Update: claude plugin update vibecheck (Claude Code) or npx skills add ribato22/vibecheck (other agents).

v1.0.0: launch audit for AI-built apps

First public release 🚦

vibecheck audits AI-built ("vibe-coded") apps before launch and tells you, in plain language, whether it's safe to ship.

• /vibecheck:check: 0–100 Launch Score, 🔴 NO-GO / 🟡 FIX FIRST / 🟢 GO verdict, and a report with a copy-paste fix prompt for every finding
• /vibecheck:fix: fixes findings one at a time, criticals first, and shows the before → after score
• /vibecheck:unstuck: breaks the "AI fix loop" when the same bug keeps coming back
• Guard hook: blocks the agent from hardcoding API keys or committing/pushing .env
• Zero-dependency scanner (60+ checks) that also runs in CI: --fail-on critical

Covers Next.js, React/Vite, Supabase, Firebase, Stripe, Midtrans, Xendit, OpenAI/Anthropic/Gemini, Express, FastAPI/Flask/Django and Expo.

Install (Claude Code)
/plugin marketplace add ribato22/vibecheck
/plugin install vibecheck@vibecheck