Antibody

Landing/URL Scan
very simplified workflow
Simple and easy (for da vibecoders)

Inspiration

Vibecoding has taken the world by storm. But, can we really trust this influx of vibecoded sites with our personal information? And if we’re the ones building, how can we be sure that our data isn’t exposed and that our endpoints won’t be hammered?

We wanted something that acts like a teammate: it finds the holes, proves they’re real, fixes them, and has your back while you’re away.

Sooo... we built Antibody, the immune system for vibe-coded apps!!

What it does

Antibody scans your live app URL for security flaws to give you an idea of what risks you could be facing if no changes are made. But it doesn’t just end at a scan, it beats open source static code audits because Antibody can simulate real attacks on your site and oftentimes, the vulnerabilities are not visible through just the codebase.

Factory’s Droid will fix up the code and Antibody will always re-run a new wave of attacks to ensure that the patched up version is up to par and actually secure. You can be hands-off on this whole process and simply come back once you get an iMessage text on your phone from Antibody (thanks to Photon)! The fix can then be approved by simply texting back and a Pull Request link follows, allowing you easy access to merge the new patches. Antibody never changes the code itself, Droid works on a throwaway copy of the code and the attacks are also run here, never targeting production code.

Additionally, Antibody’s real-time shield always checks every request made to the server before running any code and Chalk takes less than 1/10th of a second to analyze and spit out a risk score, determining if the events are of malicious intent. If yes, the attack is automatically blocked and Droid will once again run fixes wherever necessary. Photon will alert the user through messages or even escalate to a phone call if attacks don’t cease.

How we built it

Antibody is written in TypeScript. The website runs on Next.js on Vercel, project data lives in Supabase, and a long-running orchestrator (Chalk scaling group) handles fixes, texts and calls.

Factory (Droid SDK) Droid writes the fixes. For each issue, Antibody starts a headless Droid session on a throwaway clone of the owner’s repo and asks for the smallest change that removes the root cause, plus a plain-English summary for people who aren’t security experts. We kept Droid on a short leash: it can only edit files (its shell tool is turned off), it never touches the real checkout, and it can’t merge. Antibody records the exact change with git, then checks Droid’s work itself instead of trusting Droid’s own report. If the user pushes back (“don’t touch the login page” or “UNDO” in iMessages), Droid revises the fix. Very easy to use, we really enjoyed playing around with Droid.

Chalk Chalk powers the live shield and hosts our orchestrator. Every sensitive request to a protected app is scored by a Chalk resolver in about a tenth of a second, and comes back as allow, slow down or block, with a reason a person can read. If Chalk is ever slow or unreachable, the same rules run locally, so the app never goes down and attacks are still stopped. The orchestrator itself runs on a Chalk scaling group. Chalk is really cool and we wish we had more time to explore more of the features!!

Photon 2.0 Photon is how Antibody talks to you! Users link their phone by texting a code to the Antibody iMessage line. After that, Antibody texts when a fix is ready (“reply YES to open the pull request”) and when it blocks an attack. Owners can also reply STATUS or UNDO. If an urgent alert goes unanswered, Antibody calls through Photon’s voice line to an ElevenLabs voice agent. The agent only states the facts we pass it, and the text thread picks up where the call left off. This was the first time any of us had ever worked with voice agents and it was really cool to have this opportunity to work with Photon 2.0 Beta.

GitHub: a GitHub App gives scoped repo access and opens pull requests (Antibody never merges), and GitHub OAuth handles sign-in.

Challenges we ran into

Proving a site is yours without the friction. Our first version asked owners to add a verification file to their site. But, we soon realized that nobody wants to edit their site just to try a new tool. We switched to simply “Connect Vercel”: if the domain is on your Vercel account, it’s yours. This can be expanded on in the future to support other hosting platforms.

Patched copies that wouldn’t start. Real apps need databases and API keys to boot, which a test copy doesn’t have. We run the repo’s own setup step and fill its .env.example with harmless stand-ins. We also never hand the owner’s code any of Antibody’s own secrets.

Many moving parts. We ran across Vercel, Chalk, Supabase, GitHub and Photon at once and dealing with all these different parts and trying to get them to fit together was a daunting task, but, to us, a worthwhile one.

Accomplishments that we're proud of

Built with guardrails. Antibody never merges anything itself. Droid can only edit files in a throwaway copy, the owner’s code never gets Antibody’s secrets, and the full tests only run on sites you’ve proven are yours. All merges are done by the human, you!

Anyone can use it, not just us. You sign in with GitHub and connect your own GitHub and Vercel accounts, with no setup on our side. A teammate ran it on her own app (Helia), and that’s how we found and fixed the case where real-world apps wouldn’t start for testing. Although the demo video shows only localhost, it is proven to work on deployed sites as well.

We didn’t take the AI’s word for any fix. Every fix is checked by Antibody itself before anyone sees it. It re-tests and attacks the patched copy and also compares the copy’s other pages against the live site to make sure nothing else was affected.

What we learned

Real-world apps are messy. Our sample app worked perfectly. The first real app a teammate tried needed a database, several API keys and a setup step before it would even start. Testing against someone else’s real project taught us more than any amount of testing against our own.

Phones and voice are their own world. Carrier rules, shared iMessage lines, SIP calls and a voice agent that needs the right facts at the right moment: none of it shows up until you test on a real phone. Every one of those bugs only appeared when a real phone was in someone’s hand.

Our North Star

ANYONE who poured their time and energy into building an app has essentially birthed a baby of passion and idea into this world and EVERYONE should have the power to keep their baby safe.