# CodeVibes

> AI-powered code review tool that scans GitHub repositories to detect security vulnerabilities, bugs, and code quality issues, delivering a quantifiable Vibe Score with actionable fix suggestions.

CodeVibes is an open-source AI code analysis tool built by Danish Akhtar that scans GitHub repositories using a hybrid rule-and-AI approach to surface security vulnerabilities, bugs, performance issues, and code quality problems. It is available both as a hosted web app at codevibes.akadanish.dev and as a self-hostable project under the MIT License. The tool is currently in active development, with version 1.2.1 live on the hosted platform.

## What It Is

CodeVibes combines 80+ regex detection rules with DeepSeek AI to analyze public and private GitHub repositories. The regex layer catches known patterns quickly, while the AI layer handles semantically complex issues that pattern matching alone would miss. Results are streamed in real time and organized into a prioritized report, culminating in a 0–100 **Vibe Score** that reflects the overall health of the codebase. The project positions itself as an accessible alternative to enterprise code review tools, with the tagline "AI Code Review for Developers Who Can't Afford CodeRabbit."

## Priority-Based Scanning Architecture

Analysis runs in three sequential tiers, each requiring user approval before proceeding:

- **P1 – Security (Critical first):** Hardcoded secrets (AWS keys, Stripe keys, JWTs), SQL/NoSQL/command injection, auth bypass, XSS/CSRF vulnerabilities, and missing JWT verification.
- **P2 – Bugs & Performance:** N+1 queries, race conditions, memory leaks, unhandled promises, and off-by-one errors.
- **P3 – Code Quality:** DRY violations, naming and complexity issues, deprecated API usage, and testability concerns.

The backend fetches repository file trees via the GitHub API (using Octokit), categorizes files by priority, then streams AI analysis results back to the frontend via Server-Sent Events (SSE).

## Tech Stack and Deployment Model

The project is built with React 18 + Vite on the frontend, Node.js + Express on the backend, and Better-SQLite3 for local history storage. State management uses Zustand. The AI layer calls the DeepSeek API for streaming analysis. Self-hosting requires Node.js v18+, a DeepSeek API key, and optionally a GitHub token for private repository access. A BYOK (Bring Your Own Key) mode lets users supply their own DeepSeek API key for unlimited scans on the hosted platform.

Key infrastructure details:
- AES-256 encryption noted on the hosted platform; no repository code is stored server-side
- Smart Cache allows reuse of recent community scans for the same repository
- Parallel file fetching (5 concurrent requests) and GitHub Tree API caching reduce scan latency

## Update: v1.2.1 (Hosted) / v1.0.2 (GitHub Release)

The GitHub repository's latest tagged release is **v1.0.2** ("Prompt Optimization and Reliability Improvements"), published January 12, 2026. The hosted platform displays **v1.2.1**, indicating continued development beyond the tagged release. Notable changes across recent versions include:

- **v1.0.0:** Parallel file fetching (3–5× faster), GitHub Tree API caching (80% fewer API calls), fixed history-saving SQL bug, fixed DeepSeek response truncation by raising max_tokens.
- **v1.0.1:** New changelog page, trust indicator badges (AES-256, Privacy, Open Source), FAQ section added to homepage.
- **v1.0.2:** Expanded secret detection (AWS, Stripe, Google, and more), critical severity for live keys, automated async error and memory leak detection.

The repository has 145 stars and 26 forks as reported by GitHub metadata, with zero open issues as of the last update.

## Who It's For

CodeVibes targets individual developers, indie hackers, and small teams who want automated security and quality feedback on their GitHub repositories without the cost of enterprise tools. The hosted free tier supports public repositories with no credit card required. Private repository access requires GitHub OAuth login. The BYOK mode removes scan limits for users who supply their own DeepSeek API key.

## Features
- AI-powered code analysis using DeepSeek
- 80+ regex detection rules for known vulnerability patterns
- Three-tier priority scanning: Security (P1), Bugs (P2), Quality (P3)
- Real-time streaming results via Server-Sent Events
- Vibe Score (0-100) quantifying codebase health
- Smart Cache for reusing recent community scans
- BYOK (Bring Your Own Key) mode for unlimited scans
- PDF and JSON report export
- GitHub OAuth for private repository access
- AES-256 encryption; no code stored server-side
- Scan history tracking
- Actionable fix suggestions with code examples
- Parallel file fetching for faster analysis
- Secret detection (AWS, Stripe, Google, JWT keys)
- SQL/NoSQL/command injection detection
- XSS/CSRF vulnerability detection
- N+1 query and memory leak detection
- Self-hostable under MIT License

## Integrations
GitHub, DeepSeek AI, GitHub OAuth

## Platforms
WEB, API, CLI

## Pricing
Open Source, Free tier available

## Version
v1.2.1

## Links
- Website: https://codevibes.akadanish.dev
- Documentation: https://codevibes.akadanish.dev/documentation
- Repository: https://github.com/danish296/codevibes
- EveryDev.ai: https://www.everydev.ai/tools/codevibes