Why we built this

The problem I had

I'm a vibe coder. I ship apps with Cursor, Claude Code and the rest of them, and some of them run for real people now, not just for me. A few make money. For a while I had no way to check whether any of them had a hole in them. A security advisory would come out somewhere, or Dependabot would open a pull request, and I would think: is that one of mine? Which app? Which version am I even running? I kept a mental list. The mental list did not work.

What I tried

I tried reading advisories as they came out. There were too many, and most did not touch anything I actually ran. I already used Dependabot on every repo, which helped, but it only knows about a repository. It does not know that my app also runs on a particular version of Node, sits behind a particular host, or talks to Stripe and Supabase. And sometimes the thing with the hole is not a dependency I chose at all. It is the framework itself.

What I wanted instead

One page that shows every app I run, in one place. An email only when a version I actually use has a real problem, not a wall of advisories I have to sort through myself. And when something does need fixing, the exact command, plus a prompt I can hand straight to my AI tool to review the change before I run it, rather than a vague warning and a link.

How this sits next to Dependabot

I still use Dependabot, and you should too. It opens pull requests one repository at a time. VibeBeacon gives me one page across every app I run. It adds the runtime version and its end-of-life date, and shows security news from the hosts and services I list. When something matches, I get a fix plan and a prompt for my agent. It never touches the code. Use both. The comparison page covers Dependabot, npm audit, Snyk and OSV-Scanner in one place.

How it is built

I built this with Cursor and Claude Code. I read and tested the security-sensitive parts myself: sign-in, billing, matching, and the check that rejects secrets in uploads. Nobody outside has audited it yet.

What I will not do

I will not ask for your code, your keys, or access to your repository. I will not hide the price behind a “book a demo” form. And I will not pretend this is a big company with a support team standing by. It is me, in Central Coast NSW, running a small product alongside my own apps.

Who this is for

If you shipped something with Cursor, Claude Code, Lovable, Bolt or v0, and it has real users now, this is for you. You do not need to become a security person. You need one page, and one email that tells you when to act.

Where this is up to

I am one person and this is a new company. Prices may change, and if they do I will email you before the change affects you. If something breaks, or you just want to ask a question, email me directly: hello@vibebeacon.app.

Rhys, founder of VibeBeacon