VIPE
Sign in

VS Code extension

Catch security holes as you code

Vipe flags exposed secrets, SQL injection, missing auth checks and duplicate definitions in the files you have open. Detection is free, offline and needs no account. Vipe Pro scans the whole project, which adds unprotected Supabase tables, broken imports and unused code, and fixes what it finds. AI fixes explain the risk in plain English, and every fix is scanned again after it is applied. Your first 5 fixes are free.

Install for VS CodeComing soon

The extension isn't published yet. This page links to the VS Code Marketplace and Open VSX on launch day.

Or try it without installing: scan a project online

For VS Code, Cursor, Windsurf, VSCodium and VS Code Insiders.

server.tsVipe · 1 issue
import Stripe from 'stripe'
import express from 'express'
const app = express()
const stripe = new Stripe('sk_live_51H…Xq9')
CriticalHardcoded secret

A live Stripe key is in your source — anyone with the repo can use it.

− new Stripe('sk_live_51H…Xq9')
+ new Stripe(process.env.STRIPE_SECRET_KEY)
Suggested by Vipe ProApply fix
app.post('/checkout', async (req, res) => {

How it works

Free in the files you open. Pro for the whole project and fixes.

  1. Free forever

    Flags issues as you code

    Vipe checks the files you have open, as you type: 22 of the 24 security checks (exposed secrets, SQL injection, missing auth checks, unverified Stripe webhooks and more) and duplicate definitions inside a file. Unlimited, offline, no account.

  2. 5 free fixes, then Pro

    Scans the project and fixes it

    Vipe Pro scans the whole project in the background, including files your AI tools write to disk, with all 24 security checks and 3 build checks (broken imports, duplicate definitions, unused code). A fix is one click: Vipe shows the diff, explains the risk in plain English, and checks the file again afterwards. Your first 5 fixes are free.

  3. Private

    Your code stays yours

    Detection and build fixes happen on your machine; for a build fix, Vipe is only told that one fix was used. An AI fix sends just the handful of lines around the finding, and nothing is stored.

Free and Pro

Free to catch. Pro to fix.

Free

Catch problems in the files you work on.

$0forever
  • Live detection in the files you open: 22 security checks and duplicate definitions. Unlimited, offline, no account needed
  • A notification when a file written outside the editor has a certain security issue, with the issue count for the whole project
  • 5 fixes to try, security or build issues, with a GitHub sign-in
Coming soon
Recommended

Pro

The whole project scanned, and problems fixed for you.

$12per month
  • Everything in Free
  • Whole-project scan in the background: all 27 editor checks, including the ones that compare files
  • 300 AI fixes a month (security). Unlimited detection and build fixes
  • Every fix is checked: Vipe scans the file again and tells you if the issue is not resolved
  • A plain-English explanation with each AI fix
  • Cancel anytime — Pro runs to the end of the paid month

No install needed

Try it on a project first

Upload a project and the online scan runs 26 checks on it once. Every finding names the file and the line, with a fix and a plain-language explanation for up to 12 security findings. Your first scan is free and needs no account; after that a scan uses one credit. Your code is deleted as soon as the scan completes.