You pasted your code, hit "Check My Vibe," and got a number. Maybe it's a 42. Maybe it's an 88. Maybe you're staring at a purple "Immaculate" badge wondering if you actually wrote code that good.
Here's how the scoring actually works, what each tier means, and what you should do with the number you got.
The Vibe Score: 0–100
Your Vibe Score is a composite of two category scores:
- Security (55% weight) — Are there vulnerabilities in your code? SQL injection, hardcoded secrets, XSS vectors, missing authentication, insecure configurations.
- Quality (45% weight) — Is the code well-structured? Deep nesting, god functions, silent error swallowing, callback hell, missing error handling.
The formula is straightforward: overallScore = (security × 0.55) + (quality × 0.45)
Each category starts at 100 and takes deductions based on the issues found. The severity of each issue determines how much it costs you:
- Critical — Major deductions. A single SQL injection or hardcoded production secret will tank your score.
- High — Significant deductions. Missing auth on sensitive routes, XSS vectors, weak cryptography.
- Medium — Moderate deductions. Deep nesting, overly complex functions, missing input validation.
- Low — Minor deductions. Style issues, missing documentation on complex code, minor structural concerns.
There are also hard caps. If your code has a critical security vulnerability, your overall score can't exceed 35 no matter how clean the rest of the code is. A critical issue plus a high severity issue caps you at 25. The logic is simple: you can't have "good" code if it has a wide-open security hole.
The Four Tiers
Dead Vibe (0–40) 🔴
Your code has serious problems. There are critical or high-severity security vulnerabilities, and likely multiple quality issues stacked on top. Do not ship this.
This doesn't mean your code is garbage — it means it's not ready. Most Dead Vibe scores come from a couple of fixable issues: a hardcoded API key, an unparameterized SQL query, or an admin route with no auth check. Fix the critical issues and you'll likely jump 30-40 points.
Off Vibe (41–65) 🟡
Your code works, and it probably doesn't have any critical security holes, but it has meaningful issues that should be addressed. Maybe there's moderate-severity security concerns, or the code structure is getting unwieldy.
Off Vibe is the most common score for AI-generated code on a first scan. It's not a failing grade — it's a "you're close, keep going" grade. Focus on the high and medium issues first.
Good Vibe (66–85) 🟢
Solid code. No critical issues, maybe a few medium-severity findings. The structure is clean, error handling is present, and the security posture is reasonable.
A score of 67 and a score of 84 are both "Good Vibe," but they feel very different. A 67 means you just crossed the threshold — there are still things to clean up. An 84 means you're in great shape and the remaining issues are mostly polish.
Most production code from experienced developers falls in this range. If your vibe-coded project scores here, you're doing better than the majority.
Immaculate (86–100) 🟣
Exceptional code. Clean architecture, solid error handling, no security vulnerabilities detected, good documentation practices. This is what production-ready code looks like.
Immaculate scores on snippet scans are achievable but uncommon. On full repo scans (coming soon), they're rare — because real-world codebases always have some tech debt. If you hit Immaculate on a meaningful chunk of code, you should be genuinely proud.
What the score doesn't tell you
Your Vibe Score is an automated assessment. It catches known patterns and common vulnerabilities. It does not:
- Verify business logic. We can tell you that your payment endpoint has no auth check, but we can't tell you if your pricing calculation is correct.
- Test runtime behavior. Static analysis catches code patterns, not runtime bugs. Your code might score 90 and still have a race condition that only shows up under load.
- Replace a full security audit. For anything handling real money, real user data, or real compliance requirements, automated scanning is a starting point — not the finish line.
That's why we offer human reviews alongside the automated check. The algorithm catches the 80%. A senior developer catches the other 20%.
What to do with your score
- Don't panic about a low score. Most first scans are lower than expected. That's normal — it's why the tool exists.
- Fix critical issues first. They have the biggest impact on both your score and your actual security.
- Re-scan after fixing. Watch the number climb. It's satisfying.
- Aim for Good Vibe (66+) as your shipping threshold. That's a reasonable bar for a POC or MVP.
- Consider certification for production launches. If you're putting something in front of real users with real data, a human review gives you confidence that automation can't.
Your Vibe Score is a conversation starter, not a final judgment. Use it to find the gaps, fix them, and ship with confidence.
---
Want to see your score? Check your code now — it's free, no account required. And if you want to understand the vulnerabilities behind low scores, read why vibe code has 2.74x more vulnerabilities.