How does a VibeCheck scan work?
A VibeCheck scan starts only after you prove you own the origin and consent, then runs read-only checks and returns a score and a report.
How do I prove I own the origin?
Publish the one-time token as a DNS TXT record on the hostname, or on _vibecheck, or as the entire body of /.well-known/vibecheck-verify.txt on that origin.
What consent does VibeCheck require?
Check the consent box in the scan form. Active probes do not start until both the ownership proof and the consent box are present.
What does the scan actually request?
VibeCheck requests pages and public files, and it may send a few tiny unauthenticated POST requests to see whether a login, webhook, or AI route rejects bad input. It does not send PUT, PATCH, or DELETE. A paid full report can also sign in with up to two throwaway test accounts and then send only GET and HEAD, plus that login request.
What do I see when the scan finishes?
A finished scan shows a score out of 100, family-by-family coverage, severity counts, and two sample issues. The rest of the evidence stays locked on the free teaser.
How do I unlock the full report?
The $49 plan unlocks every finding on that scan, with location, redacted evidence, and a copy-paste fix. The $99 plan adds one credit to rescan after you ship fixes. $29 per month monitoring schedules rescans and alerts you when a new high-severity issue appears. Listed prices are plus applicable taxes.
What will the worker refuse to do?
The worker does not send PUT, PATCH, or DELETE, and it refuses link-local and metadata addresses. It does not start probes until the ownership file or DNS TXT record is in place and the consent box is checked.