Pricing
Flat prices, no hourly surprises. The Rescue Report fee is credited 100% toward a Fix Pack if you upgrade within 14 days. If we miss the 48-hour maximum on a report, you get a full refund.
Vibe Check
Free
Passive scan of your live URL: secrets in your JavaScript bundle, exposed files, security headers, and an A–F grade with copy-paste fix prompts.
- Live URL only, no code access
- Leaked keys in the shipped bundle
- Security headers and exposed files
- Top 3 issues plus fix prompts
Turnaround: ~2 minutes
Free Vibe Check (coming soon)Rescue Report
$149
Launch offer: $99 for our first 10 founders
Agents scan your repo and live app (secrets, database rules, dependencies, build, page load), and a human verifies every critical finding before you see it.
- Repo + live URL
- Supabase RLS and grants review
- Build and blank-screen check
- Ranked fixes with Cursor/Lovable prompts
- Credited 100% toward a Fix Pack
Turnaround: 24 hours (48 max)
Launching soonFix Pack
$499
We fix up to 3 critical or high issues as pull requests with tests, then re-scan to show before and after.
- Up to 3 critical/high fixes
- Pull requests you review and merge
- Before/after re-scan
- Key-rotation checklist
Turnaround: 72 hours
Launching soonRescue Sprint
From $1,500
For bigger rescues: auth or payments rework, deploy pipeline, up to about 8 issues, with handover docs.
- Scoped from your Rescue Report
- Fixed quote before work starts
- Handover notes
Turnaround: 5–7 business days
Launching soonAdd-ons
Guard · $49/mo
Weekly re-scans of your URL and repo, alerts on new leaks or open tables, one small fix per month. Coming after launch.
Same-day emergency · +$99
Your key just leaked? We start the same day.
Pricing questions
How much does VibeCPR cost?
The Vibe Check is free. A full Rescue Report is $149 ($99 for our first 10 founders) and is credited toward a Fix Pack. A Fix Pack, where we fix up to 3 critical or high issues as pull requests, is $499. Larger Rescue Sprints start at $1,500 and are quoted before work begins.
Do you need my production keys or database password?
No. We never ask for production secrets, service_role keys or database passwords. For a Rescue Report we use read-only access to one repository (or a zip) and a schema export with no user data. Fixes are delivered as pull requests you review and merge yourself.
Is a VibeCPR report a penetration test or security certification?
No. A Rescue Report is a point-in-time, automated review with human sign-off. It catches the most common, most damaging mistakes in AI-built apps, but it cannot prove the absence of vulnerabilities and is not a certification.
Paid orders aren't open yet. We're launching soon, and the waitlist for the 10 founder spots opens shortly.