Plora - Vibe Code Security Auditor

In an age of AI and unleashed productivity, there still remains a marginal resemblance of errors that still persist, unbeknownst to non-technical founders. Plora is designed to fill that gap.

Comment

Inspiration

I built a VAT tax helper on Lovable that grew to about 2,000 users. Looking at the code later - first in Fable 5, then GPT 5.6 - I realized something scary: the customer database could be exposed. That stuck with me. Agent tools ship apps fast, but they also ship the same blind spots: open data paths, missing auth, secrets in the wrong place. Paying a model every time you want a security pass works, but it’s still costs (and Fable 5 isn’t cheap for everyone). I wanted a vibe-code security auditor that catches those failure modes locally, at $0, without burning API credits just to ask “is this safe?”. I am a big fan of open-source technology(while recognizing the need for closed frontier labs) and making a cheap model would be extremely useful for small businesses especially with an usable UI.

What it does

Plora is a vibe-code security auditor: a zero-cost scanner for agent-generated codebases (Cursor, Codex, Lovable, etc.).

  • Ingest from GitHub (OAuth or PAT), a public repo URL, folder/ZIP upload, or the CLI (plora scan .)
  • Scan in three depths - Pulse, Audit, and Deep - with local static analysis (no LLM in the scan path, $0 runtime cost)
  • Score & grade the project with findings: secrets, missing auth, injection, agent smells, misconfig
  • Remediate via project chat, paste-ready Cursor/Codex prompts, autofix, optional GitHub push, and a PDF report

How we built it

  • Next.js 15 + React 19 + Tailwind for the workspace (projects, scans, chats, plans)
  • Custom analyzer: ingest → walk → secrets / patterns / Babel AST auth / taint / advanced checks → score → suggested fixes
  • GitHub OAuth/PAT + shallow clone/zipball; CLI for local Cursor folders and CI exit codes
  • No model API in the scan path - security checks stay free and explainable

Challenges we ran into

Time. This was built in college - skipping meals, coming back to campus work, coding until 2am, and still doing homework in the same stretch. Shipping a real ingest → scan → fix product under that constraint meant cutting scope hard and trusting the demo path.

Making AI actually help. Using GPT 5.6 made the build much easier - breaking the product, faster iteration on the analyzer, UI, and remediation flow - without pretending a model alone is a security product. The hard part was still encoding agent-shaped bugs into high-signal local rules so Plora doesn’t need a paid model just to scan.

Accomplishments that we're proud of

  • Full loop: ingest → scan → score → chat → prompts → autofix → PDF/CLI
  • $0 scan path by design - local static analysis, no model bills for auditing
  • Rules tuned to vibe-code smells, inspired by a real app that could have leaked customer data
  • Dual surface: web workspace + CLI

What we learned

  • Agent-generated vulnerabilities are patternizable - the same failure modes show up across Lovable/Cursor/Codex apps
  • Security for vibe coders has to be cheap and local; not everyone can afford a strong model pass on every project
  • Detection isn’t enough - remediation UX (prompts, chat, autofix) is what makes people actually fix things
  • Under sleep and homework pressure, a clear pipeline beats a bloated feature list

What's next for Plora - Vibe Code Security Auditor

  • Delete what people don’t need - strip the demo noise and keep only the parts that help vibe coders ship safer apps
  • Break it, then grow it - stress the scanner on real agent exports, find where it fails, harden those paths, then expand coverage
  • A cheap model for Plora only - optional lightweight advisor for chat/remediation, while scanning stays $0 and local

[mainly written by GPT 5.6:) partially edited by me]

Built With

Share this project:

Updates