Get started
Introduction
VIfix finds the security issues AI coding tools leave behind, explains them in plain English, and helps you ship the fix. It runs on your computer, so your code never leaves it.
What is VIfix?#
VIfix is a desktop app for macOS and Windows. Point it at a project folder, a private GitHub repository or a live database, and it reports real-world risks: leaked keys, injectable queries, missing Row Level Security, unauthenticated API routes and more.
Every finding comes with the vulnerable lines, why it matters, and a fix you can review as a diff before applying it locally or opening a pull request.
What it checks#
- Secrets: provider API keys, Supabase service_role keys, database URLs, and secrets exposed through
NEXT_PUBLIC_variables. - Injection: SQL built from strings, PostgREST filter injection, shell command injection.
- OWASP issues: broken object-level authorization, unauthenticated mutating routes, XSS sinks, weak crypto, permissive CORS.
- Supabase RLS: tables without Row Level Security,
using (true)policies, policies trustinguser_metadata. - Live databases: PostgreSQL/Supabase, MySQL and MongoDB configuration and permission gaps.
The full list lives in Security rules.
How it works#
Scans run inside the desktop app. Your account (on getvifix.com) only tracks your plan and how many scans you've used. Source code, tokens and database passwords stay on your machine, and credentials are stored in your operating system's keychain.
Works with your AI tools