M06 · LOY-01Loyalty pointsThe rule was in its file
The company ruleOne loyalty point per euro paid in money. None on the gift-card share.
ViolatedA rules file
Find, Fix, Repeat.Secure your
The security review your AI agent skips.
Free to startNo card
Inside the agents you already use
★★★★★5.0on G2
Why flaws ship
Your agent writes the line. Nobody reads it.
Thousands of lines a day. No review catches the flaw.
Shipped with the flawClaude CodeAgent session, alone
Claude CodeAgent session, aloneThinking ...
Update ( src/db/users.repo.ts )
db . query('SELECT * FROM users WHERE id = ' + id)Tests passing
Opening pull request #482
» auto modeVibeDefend: off
A rules file does not fix it.
The rule was in its file, exact. The agent broke it anyway.
What VibeDefend changes
Two minutes to install.
One command. It detects every agent on your machine.
$npx -y @cybedefend/vibedefend@latest install✓Claude Code✓Cursor✓Windsurf✓GitHub Copilot✓OpenAI CodexYour rules arrive at the line.
Mined from your code, plus OWASP, SOC 2, GDPR, ISO 27001.
Claude Code
VibeDefendvibedefend . business-rules.inject
tenant scopingsoft-deleteaudit-on-write
vibedefend . security-rules.inject
OWASPSOC 2GDPRISO 27001
Thinking ...
Update ( src/db/users.repo.ts )
db . query('SELECT * FROM users WHERE id = ' + id)vibedefend . scan.diff
Code AnalysisIaCSecrets
new finding in diff → SQL Injection
» auto modeVibeDefend active
Scanned before the pull request.
One finding, with its fix. The agent rewrites the line.
-db.query('SELECT * FROM users WHERE id = ' + id)
+db.query('SELECT * FROM users WHERE id = $1', [id])
SQL Injection, fixed at the line it edited
Rule LOY-01 applied exactly
Dangerous commands never run.
A schema drop, a destructive sudo. Stopped before they fire.
sudo rm -rf /etc/BLOCKEDdestructive sudo outside the project· no-destructive-sudo
DROP SCHEMA public CASCADEBLOCKEDschema drop against a live database· no-destructive-sql
requests-toolbelt-asyncBLOCKEDpackage does not exist on the registry· package does not exist
Every finding, live in the session.
One dashboard for your team. The same list, inside the agent.
What you get
What it covers.
- Business logicYour own rules, mined from your code.
- ComplianceOWASP, SOC 2, GDPR, ISO 27001, in the session.
- Dangerous actionsChecked before the command runs.
- Every scannerSAST, SCA, secrets, IaC and CI/CD, live.
- MCP securityEvery MCP server the agent talks to, checked.
Measured, not promised
Measured on a real codebase.
Three agents, blind audits, everything public.
0%of your rules followed exactly12% without it
$0saved a year, for twenty developers×37 on the licence and the tokens
2 minto install, one commandno card, no pipeline
Voices
They ship with it every day.
Vulnerability analysis and remediation have become significantly faster. We save valuable time every day.
OlivierTech Lead, Koddex
Questions
Before you install.
Does my code leave my machine?
What you send for analysis does, and it stays in the region you picked at install: Paris for EU customers on SecNumCloud-qualified infrastructure, Iowa for US customers, on our own self-hosted models, never a third-party AI API. The guard decides on your machine, its telemetry carries metadata only (no prompt content, no raw code), findings never cross regions, and your code is never used to train a model.
Which agents does it work with?
The installer wires Claude Code, Cursor, Windsurf, GitHub Copilot and Codex. Any other agent that speaks MCP works in bring-your-own-config mode, including Gemini CLI, Cline, Continue.dev and Zed.
What does the free plan include, and what happens after?
50 AI credits and 10 static scans, with access to the whole platform, no card and no time limit. Run your first scan and we mail you a promo code. When you need more, the Developer plan starts at €19 or $21 a month.
Is this another scanner that floods the agent with alerts?
No. Legacy scanners run on commits and bury you in false positives. VibeDefend runs at agent-time on the diff being written, with reachability and framework awareness, and hands the agent one finding it can act on, with the fix.
Can I read the study before I sign up?
Yes, and you should. The 36-page paper, the 90 transcripts, the blind audits and the six cases where the layer did not deliver are in the public repository linked on this page.