Prompt template

If you would rather not open a terminal, paste one of these into the tool you built the app with. Use the first if it can run commands, the second if it cannot.

Which one do I need?

Shell version: Cursor, Claude Code, Windsurf, Cline, Copilot agent mode, any local editor with a terminal.
No-shell version: Lovable, Bolt, v0, Replit Agent chat and anything else running in a browser sandbox with no command line.

Swap the key in

Both prompts contain vb_live_your_key_here. Replace it with your own key before pasting, or delete the --key part if the key is already in your environment.

Shell version

This asks the tool to run the scanner and hand you the result. It is short on purpose: long prompts get truncated or half-followed.

prompt (shell)

You have shell access to this project. Please do the following, then stop.

1. Run this command from the project root:

   npx vibebeacon@latest scan --upload --key vb_live_your_key_here

2. It writes a file called vibebeacon.json and uploads it to VibeBeacon.
   The file lists runtimes, frameworks, dependencies and services with versions.
   It contains no source code, no file contents and no environment values.

3. Paste the command output back to me, including the dashboard link it prints.

Do not read or open any .env file. Do not add the API key to any file that gets
committed. If the command fails, show me the exact error and stop.

No-shell version

This asks the tool to read the package files and write the JSON itself. It takes longer and the versions are less precise, because a range like ^18.2.0 is not the version you actually have installed. Entries built this way are marked unresolved and we match them conservatively, so you get fewer false alarms and, occasionally, a missed match.

prompt (no shell)

You cannot run a shell here, so please build the file by hand.

Read package.json and the lockfile (package-lock.json, pnpm-lock.yaml or yarn.lock),
plus any requirements.txt, poetry.lock, go.mod, Cargo.lock, Gemfile.lock or
composer.lock in this project. Then write a file called vibebeacon.json in this
exact shape:

{
  "schemaVersion": 1,
  "generator": { "name": "manual", "version": "1" },
  "generatedAt": "<current UTC time, ISO 8601>",
  "app": {
    "name": "<the app name, 1 to 80 characters>",
    "kind": "web",
    "hosting": ["vercel"],
    "aiTools": ["lovable"]
  },
  "runtimes": [{ "name": "node", "version": "22.11.0" }],
  "frameworks": [{ "name": "next", "version": "15.1.0", "ecosystem": "npm" }],
  "dependencies": [
    { "name": "react", "version": "18.3.1", "ecosystem": "npm", "direct": true, "dev": false }
  ],
  "services": [{ "name": "stripe" }],
  "infrastructure": [{ "name": "postgres", "version": "16" }]
}

Rules:
- Use the exact resolved version from the lockfile where you can. If you only have
  a range like ^18.2.0, write 18.2.0 and add "resolved": false to that entry.
- ecosystem is one of npm, PyPI, Go, crates.io, RubyGems, Packagist, Maven, NuGet, Hex, Pub.
- Include direct dependencies at minimum. Dev dependencies are welcome, mark them "dev": true.
- Never read .env files. Never include keys, tokens, URLs with credentials, file paths,
  repo URLs or database names. Names and versions only.

When the file is written, show it to me so I can upload it.

Then upload the file

When the tool shows you the finished vibebeacon.json, drag it onto the upload box on your dashboard, or paste the JSON straight in. We parse it, run a match immediately and show you what we found.

If the answer looks wrong

Missing dependencies: the tool probably read only package.json. Ask it to read the lockfile as well.
Versions with carets or tildes: ask it to use the resolved version from the lockfile, or accept the unresolved flag.
A refusal to write the file: some tools will not create files outside their own structure. Ask for the JSON in the chat instead and paste it into the dashboard.
Anything secret-shaped in the output: delete it. Our server rejects those manifests anyway, and the privacy page explains what trips the check.