How this sits next to the tools you already have
Use them. VibeBeacon is the watch across apps that those tools were not built to be.
Dependabot
Use it. It owns the pull request in one GitHub repository. VibeBeacon does not replace that. It watches runtimes, hosts and services as well as packages, across every app you run, without repository access, and puts the result on one page with a fix plan you can hand to an AI tool.
npm audit
Use it in the folder you are in. It reads the lockfile on that machine. It covers npm packages, including Next.js, but not the Node runtime binary, hosting configuration or a continuing inventory of your other apps. VibeBeacon is the ongoing watch after you close the terminal.
Snyk
Snyk is a full scanner with a free tier and a large product around it. If you already live in Snyk, stay there. VibeBeacon is for people who will not give a scanner their repository, and who want one cheap page per app rather than another platform to learn.
OSV-Scanner
OSV-Scanner is the command-line check against the OSV database. We ingest OSV too. The difference is hosting: VibeBeacon keeps the manifest, matches it on a schedule, and emails you. OSV-Scanner can also run in CI; use it for checks in your development workflow.
The origin story, including how it is built, is on the why page.
Questions a careful reader asks
Is a list of my vulnerable versions a hit list?
Exposed email addresses, inventory and app details can help attackers target customers. We minimise stored data and protect it, but a breach could still cause harm. The privacy and security pages describe the data and controls.
Was this vibe-coded?
It was built with Cursor and Claude, then reviewed. Auth, billing, matching and the secret rejector are not accepted unreviewed. The agent files in the repo are how the work is organised, not a claim that nobody read the code.
How fast is a CVE in my inbox?
Ingestion is scheduled every 10 minutes; lifecycle and bulk reconciliation have longer cycles. Your last uploaded inventory is matched every 30 minutes on Free and Pro, and every 10 minutes on Team. That is a polling interval, not a measured CVE-to-inbox study. We have not published that number.
What is the false-positive policy?
We match the version you uploaded against the advisory's affected range. If the version is a floor rather than a pin, the UI says so. We would rather show a conservative match than hide a real one. If a match looks wrong, email hello@vibebeacon.app.
Who is the legal party?
The registered ABN entity is The Trustee for Evans Family Trust, ABN 91 553 120 290, in New South Wales, Australia. See the terms for operator and billing details. Prices are in US dollars.
What if you shut down?
Export everything we hold as JSON from the account. Cancel any time. Unused paid time is not refunded except where Australian Consumer Law requires a remedy. Apps pause rather than delete. There is no SLA and no second founder.
Where is the status page, and how do I prove 10 vs 30?
Last ingest, match and notify times are on /status. Free and Pro skip match ticks except :05 and :35 UTC. Team, including a live trial, matches every 10 minute tick. On-demand matching after an upload still runs on every plan.
How do I verify the client packages and their source?
The CLI and MCP server are published on npm. The source repository is private. You can inspect the exact npm tarball, but we do not offer a public source checkout. CLI 0.4.0 and MCP 0.4.1 have no provenance attestation.
How do I check you never store secrets?
Run the scanner with --json and read the file before you upload. The CLI refuses .env files. The server rejects secret-shaped fields. The privacy page shows the exact JSON we accept.
Why keep paying after I have patched everything?
New advisories keep landing. Runtimes reach end of life. You add apps. The watch is the product, not a one-off report.