Playground

This runs the real SecureVibe engine — the same scanners the CLI and MCP server use — compiled to WebAssembly and executed entirely in your browser. Nothing you paste here leaves your machine: no upload, no backend, no telemetry. The malicious-package DB, typosquat DB, and secret-detection rules are baked into the .wasm module.

Loading the engine (~8 MB, one-time)…

🔎 Scan dependencies

Paste a lockfile / manifest. Pick the filename so the right parser runs.

Filename requirements.txt package.json go.sum Cargo.lock composer.lock Gemfile.lock pom.xml requests==2.31.0 colourama==0.4.6 Scan dependencies

🔐 Scan for secrets

Paste code or config. Detection runs with entropy + hotword scoring.

GITHUB_TOKEN = "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789" STRIPE_KEY = "sk_live_4eC39HqLyjWDarjtT1zdp7dcAbCdEfGhItuv" # the canonical AWS docs example key is correctly NOT flagged: AWS_SECRET = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" Scan for secrets

Want this in your editor or CI instead of a browser tab? See Quick Start. The engine here is identical — it just happens to run client-side.