Community
The open-source edition, on your servers
$0
Forever. No card, no limit on users.
- Your SARIF scanners, run and deduped
- Unlimited projects and users
- API, CLI, MCP server and SSO included
Start free. Pay as you grow.
VibeDefend: free every month up to a free tier, then billed on usage. CybeDefend Platform: free self-hosted, or Pro and Team in our cloud, priced per seat.
Cloud
Hosted by us, with our own scanners
Per seat
Pro up to 5 seats, Team up to 25
- Everything in Community, hosted for you
- Our scanners, AI triage and AutoFix
- Projects included, more in packs of ten
Enterprise
From 26 seats, and for your auditors
On quote
Yearly contract or usage budget
- Several organisations, fine-grained roles, SCIM
- Audit logs to your SIEM, security gates
- On-premise or air-gapped, committed support
Startups get Cloud months free: 6 when incubated and not yet funded, 3 from seed to series A. Apply
Free
Every month, up to a free tier
$0
No card
- Claude Code, Cursor, Codex, Copilot, Devin Desktop, Antigravity
- Your rules before every edit
- Guards in Claude Code, Cursor, Codex and Antigravity
Business
Past the free tier
On usage
Billed per unit, up to a monthly cap
- Add a card and keep going
- A unit price that falls with volume
- A pilot with our team if you want one
Founders
Your AI-built app, audited in 24 hours
$249
Launch price until December 4
- One app: code, dependencies, secrets, configuration and database rules
- Every finding reviewed by an engineer, false alarms removed
- A plain-English report, the fixes as prompts for your agent, a call with a founder
Companies
Your teams build apps with AI agents
€600a day
One app in one business day. Fixes take about two more days, quoted after the audit.
- A report your auditor or your management can read
- A call to walk your team through it
- Fixes and a new audit if you want them
Critical findings? With Fix and Test we fix them, test the live app with your written authorization and audit it again, $1,200 with the audit fee deducted. Each report is a dated review of one app, not a guarantee or a certification.
Cloud grows with your team.
Pick the plan by the size of your team. Beyond the projects included, add them in packs of ten. Pay monthly, or yearly with one month free.
Pro, 1 to 5 seats
- Our scanners, AI triage and AutoFix
- Slack, GitHub and GitLab issues
- Team roles and pull-request checks
Team, 6 to 25 seats
- Security policies and reports
- SBOM, AI-BOM and the EU AI Act
- Jira and priority scoring
Enterprise, from 26 seats
- Several organisations, SCIM and SAML
- Audit logs to your SIEM, security gates
- On-premise or air-gapped, committed support
Compare every planHide the comparison
| Feature | CommunityOpen source | Pro1 to 5 seats | Team6 to 25 seats | EnterpriseFrom 26 seats |
|---|---|---|---|---|
| Price and limits | ||||
| Price | Free | Per seat | Per seat | On quote |
| Projects | Unlimited | 10 included, up to 100 | 30 included, up to 250 | In the contract |
| Static scans (SAST/SCA/IaC/Secrets) | Unlimited | Unlimited | Unlimited | Unlimited |
| Hosting | Your servers | EU (SecNumCloud) or US | EU (SecNumCloud) or US | On-premise, air-gapped or our cloud |
| Billing | Free, forever | Monthly, or yearly with one month free | Monthly, or yearly with one month free | Yearly contract or usage budget |
| Scanners | ||||
| Your own scanners, through SARIF | Included | Included | Included | Included |
| SAST: static analysis with reachability | Not included | Included | Included | Included |
| SCA: dependencies and license risk | Not included | Included | Included | Included |
| Secret detection: leaked tokens caught before the commit | Not included | Included | Included | Included |
| License compliance: open-source license risk, classified | Not included | Included | Included | Included |
| IaC: Terraform, CloudFormation, Ansible, Kubernetes | Not included | Included | Included | Included |
| CI/CD: GitHub Actions, GitLab CI, Jenkinsfile, Tekton | Not included | Included | Included | Included |
| Container security: image scanning and runtime context | Not included | Included | Included | Included |
| AI-BOM: discovery and inventory (EU AI Act, NIST AI RMF) | Not included | Not included | Included | Included |
| BLSA (business-logic security) | Not included | Not included | Early access | Included |
| Triage and fix | ||||
| Deduplication across scanners | Included | Included | Included | Included |
| Ranking by reachability | Included | Included | Included | Included |
| History of every finding | Included | Included | Included | Included |
| AI triage and AutoFix | Not included | Included | Included | Included |
| Cybe Security Champion (IDE copilot) | Not included | Included | Included | Included |
| Zero-Day Threat Monitoring | Not included | Included | Included | Included |
| Business-context engine | Not included | Basic | Advanced | Custom |
| Priority scoring across every project | Not included | Not included | Included | Included |
| Integrations | ||||
| GitHub & GitLab | Included | Included | Included | Included |
| IDE plugins (VS Code, JetBrains, Cursor, Claude Code) | Included | Included | Included | Included |
| API, CLI and MCP server | Included | Included | Included | Included |
| CI/CD (GitHub Actions, GitLab CI, Jenkins, Azure DevOps, Bitbucket Pipelines) | Included | Included | Included | Included |
| SSO with OIDC | Included | Included | Included | Included |
| Slack integration | Not included | Included | Included | Included |
| Task management (Jira, Linear) | Not included | Not included | Included | Included |
| Issue tracking (GitHub Issues, GitLab Issues) | Not included | Included | Included | Included |
| Pull-request comments and checks | Not included | Included | Included | Included |
| Container Registries (Docker Hub, GCR, ACR, Quay, GitHub/GitLab Registries, AWS ECR, Harbor, JFrog) | Not included | Included | Included | Included |
| SSO / SAML | Not included | Not included | Not included | Included |
| Audit logs to your SIEM | Not included | Not included | Not included | Included |
| Governance | ||||
| Team roles and project owners | Not included | Included | Included | Included |
| Security Policies | Not included | Not included | Included | Included |
| Security reports and fix times by severity | Not included | Not included | Included | Included |
| SBOM generation (CycloneDX, SPDX) | Not included | Not included | Included | Included |
| Report retention | Not included | Not included | 90 days | 365 days |
| Reports by Scanner Type | Not included | Not included | Not included | Included |
| Several organisations, fine-grained roles, SCIM | Not included | Not included | Not included | Included |
| Security gates | Not included | Not included | Not included | Included |
| Support | ||||
| Community support | Included | Included | Included | Included |
| Email support | Not included | Included | Included | Included |
| Response time | Best effort | Within 72 hours | Within 24 hours | 24/7 Priority |
| Dedicated Slack channel | Not included | Not included | Included | Included |
| Onboarding workshop | Not included | Not included | Included | Included |
| Account manager | Not included | Not included | Not included | Included |
| Uptime SLA | Your infrastructure | Best effort | Best effort | 99.5% |
| Roadmap influence | Not included | Not included | Quarterly | Direct |
What it saves you.
8×
fewer deviations from your rules
3×
fewer flaws introduced
89%
of your precise rules applied, against 12% without
Controlled study, 30 tasks, 24 August 2026. Calculate it for your team
From order to report in 24 hours
You send
- Read-only access to your repository
- The address of your live app
We audit
- Our scanners run every check
- An engineer reviews each finding
You get
- A score, with the scope and date of the review
- A 15-minute call with a founder
Questions
Can I try VibeDefend for free?
Yes. Sign in and run the install command: VibeDefend joins Claude Code, Cursor, Codex, GitHub Copilot, Devin Desktop and Google Antigravity. Every month it is free up to 1,000 rule injections, 500 guard judgments and 100 diff scans. No card.
How much does VibeDefend cost?
Nothing up to the free tier. Past it, add a card: rule injections, guard judgments and diff scans are billed on what your agents use, at a unit price that falls with volume, up to a monthly cap. A larger team can start with a pilot: write to us.
How does a pilot work?
We frame the test with your team, on your repositories and with the agents you use, and agree on what we measure. At the end, you have the figures of your own codebase.
Where is my data hosted?
In the EU on SecNumCloud-qualified infrastructure, or in the US: you choose at sign-up. Enterprise can also run on your premises or air-gapped.
How are Pro and Team priced?
Per seat, each month, with projects included. Pro covers 1 to 5 seats with 10 projects. Team covers 6 to 25 seats with 5 seats and 30 projects included, and adds policies, reports, SBOM, AI-BOM, the EU AI Act and Jira. More projects come in packs of ten. Every organisation starts with a free trial; ask us for your price. From 26 seats, Enterprise is on quote.
Who counts as a seat?
Every member of your organisation on the platform, pending invitations included, whether they push code or only read results.
What counts as a project?
A repository, or a group of repositories you track together. Pro includes 10 and goes up to 100, Team includes 30 and goes up to 250. Beyond those included, you add them in packs of ten.
Is Community really free?
Yes, forever. It runs on your servers with the scanners you choose, with no limit on projects or users, SSO included. We earn our living from the cloud, Enterprise and VibeDefend, and what is open stays open.
Can I pay yearly?
Yes. Pro and Team billed yearly give one month free, on every line.
What does the Flash Audit check?
One app: its code, its dependencies, the secrets that ended up in the browser or the repository, its configuration and its database rules. Our scanners run the checks, an engineer reviews every finding and removes the false alarms. You get a plain-English report with a score, the top fixes written as prompts to paste into your agent, and a 15-minute call with a founder. A company gets the same audit in one business day, with a report it can show its auditor.
What do you need from me, and what happens to my code?
Read-only access to the repository, the address of the live app and your written authorization. We never test a live app without it. Our working copy of your code is deleted once your report is delivered.