Getting started

1. Sign in

There are no passwords. Enter your email and we send a link, or sign in with GitHub. The GitHub scope covers your email address only, and we never ask for repository access.

2. Open your app’s project

Open the project in the builder or editor where its files live, then start an AI chat there. A fresh chat works. You do not need the original conversation.

If you have lost the project, check your builder’s project list, your saved folders or your repositories. A public website address alone cannot provide the software inventory.

3. Copy the prompt and bring back the result

Keep Add App open. Copy its message into your project’s AI chat and send it. The AI reads the available files and returns a software list called JSON. Copy the whole result back into the box on Add App, review it and press Add app.

If the AI cannot see the files, open the project first. If it gives an explanation instead of JSON, use the recovery message beside the result box. The prompt guide has the same message.

4. Check the result

The upload requests a match straight away. If processing is pending, the inventory was accepted but findings or the score are not ready. Check the result status and refresh the dashboard; missing results do not mean zero problems.

The CLI writes the app's id back into vibebeacon.json after that first upload. Keep that file, and later uploads land on the same app when you rename it, rather than matching on the name.

5. Keep it fresh

A manifest goes stale as soon as you upgrade something. A few ways to keep it current, cheapest first.

1. Do nothing. We email you when a manifest is older than 30 days.
2. Run the CLI with --watch while you work.
3. Add the GitHub Action so every push updates it.
4. Watching more than one app? scan --all walks a folder of projects and uploads every one it recognises in a single command:

npx vibebeacon@latest scan --all . --upload

6. Turn the volume where you want it

By default you get an instant email for high and critical problems that match an exact reported version, a daily digest for the rest, and news items weekly. Change the threshold per app under Settings, or read alerts and digests first.

Other methods: command line and integrations

For automatic upload, first sign in from a terminal on the machine you will scan from:

npx vibebeacon@latest login

It prints a short code and opens your browser to approve it. Once approved, the CLI and the MCP server both read the credential it stores, so scan --upload, upload and review all work with no --key flag. findings works the same way from CLI 0.4.1.

• Prefer a key you type yourself, or need one for CI? Keys live under Settings, API keys, start with vb_live_ followed by 40 characters, and are shown once. Put it in VIBEBEACON_API_KEY, or pass it with --key.
• Lost it? Revoke and make a new one. We cannot show it again.

Full detail on all three credential shapes, including the short-lived tokens used for onboarding a teammate, is on Tokens and login.

Automatic upload options

All three paths produce the same file, a short list of runtimes, frameworks, dependencies and services with versions. Pick whichever your tool supports.

npx vibebeacon@latest scan --upload

Understand the next scan

Inventory refresh is separate from verified remediation. Keep app identity and scan scope consistent, inspect changed alert IDs and reasons, and use the real score explanation. Read scan results and agent access for pending processing, read-only findings JSON and authentication errors. Choose explicit handoff and upload permissions in Fixing an alert.