How this sits next to the tools you already have
Keep using them. VibeBeacon covers a different gap: a scheduled re-check of every app you run, with an email when something new matches.
Dependabot
Keep using it. It opens upgrade pull requests in one GitHub repository at a time. VibeBeacon does not open pull requests. It keeps the last upload for every app you run, on one page, without repository access, and adds runtime end-of-life dates and a fix prompt you can hand to an AI tool. It also works for apps that are not on GitHub.
npm audit
Keep using it. It checks the npm lockfile in the folder you are in, at the moment you run it. It does not cover the Node version itself or your other apps, and it does not tell you next week when a new advisory hits a version you already shipped. VibeBeacon re-checks your last upload on a schedule and emails you.
Snyk
Snyk is a full scanner with a free tier and a lot more product around it. If you already use Snyk, stay there. VibeBeacon is smaller: no repository access, one page per app, USD $2 per extra app.
OSV-Scanner
OSV-Scanner checks a project against the OSV database from the command line or CI. We pull OSV too. The difference is that VibeBeacon keeps your manifest, re-checks it on a schedule and emails you. Use OSV-Scanner in CI if you like. The two do not conflict.
The origin story, including how it is built, is on the why page.
Questions a careful reader asks
Is a list of my vulnerable versions a hit list?
Exposed email addresses, inventory and app details can help attackers target customers. We minimise stored data and protect it, but a breach could still cause harm. The privacy and security pages describe the data and controls.
Was this vibe-coded?
Yes, mostly. It was built with Cursor and Claude Code by one person. Auth, billing, matching and the secret rejector were read and tested by hand before they shipped. No outside firm has audited it.
How fast is a CVE in my inbox?
We pull advisory feeds every 10 minutes. Your last upload is re-checked every 30 minutes on Free and Pro, and every 10 minutes on Team. Those are schedule times. We have not measured or published a CVE-to-inbox time, and it also depends on how fast each source publishes.
What is the false-positive policy?
We match the version you uploaded against the advisory's affected range. If the version is a floor rather than a pin, the UI says so. We would rather show a conservative match than hide a real one. If a match looks wrong, email hello@vibebeacon.app.
Who is the legal party?
The registered ABN entity is The Trustee for Evans Family Trust, ABN 91 553 120 290, in New South Wales, Australia. See the terms for operator and billing details. Prices are in US dollars.
What if you shut down?
Export everything we hold as JSON from the account. Cancel any time. Unused paid time is not refunded except where Australian Consumer Law requires a remedy. Apps pause rather than delete. There is no SLA and no second founder.
Where is the status page, and how do I prove 10 vs 30?
The status page shows the last ingest, match and notify times. The match job runs every 10 minutes. Free and Pro apps are only matched on the :05 and :35 UTC runs. Team apps, and apps in a live trial, are matched on every run. A new upload is matched straight away on every plan.
How do I verify the client packages and their source?
The CLI and MCP server are published on npm. The source repository is private, and we do not offer a public source checkout. CLI 0.4.0 and MCP 0.4.1 have no provenance attestation. You can still read the package you will run: npm pack vibebeacon@latest downloads the tarball, and dist/cli.js inside is not minified.
How do I check you never store secrets?
Run the scanner with --json and read the file before you upload. The CLI refuses .env files. The server rejects secret-shaped fields. The privacy page shows the exact JSON we accept.
Why keep paying after I have patched everything?
New advisories keep landing on versions you already shipped. Runtimes reach end of life. You add apps. A one-off scan only tells you about today.