What shipped, and when

Per-project agent toggles are enforced, and project cards count every finding

The Agents screen's per-project switches now actually shape that project's scans, narrowing the organization policy (never widening it), and a project-disabled deep agent hides the Integrity Index the same way an organization-level one does. Project score cards count open findings across every completed scan, including scans that produced no index.

No Integrity Index when deep agents are off

If any deep analysis agent is switched off for a scan — by the organization's Feature Access policy or by the AI-analysis privacy switch — that scan records its findings but no Integrity Index, and every score surface shows a dimmed dash with an ⓘ explaining which switch to flip. A disabled agent can no longer raise the index by reporting nothing.

Feature Access: configure what your organization runs

Settings → Access gives owners and member-managing roles one tree of switches for the whole organization: the Code Graph, webhook auto-review, each static and deep detector agent, and each plan-review skill your coding agents can call over MCP. Changes are audited and enforced server-side on routes, scans, and MCP within about thirty seconds.

Free through December 31, 2026

The free period now runs to December 31, 2026 — extended from September 30. The banner, FAQ, and page description all state the new date.

Public pages prerender and share one navigation

Every unauthenticated surface — pricing, demo, docs, comparisons, changelog, MCP, and legal — is now a prerendered page served from the CDN edge, and all of them carry the same header, so navigation is consistent and first paint no longer waits on a server render.

Faster public pages

Cumulative layout shift on the landing page dropped from 0.264 to 0.0002 with metric-matched fallback fonts and reserved space for the scan animation, and time-to-first-byte on the home page fell from 0.86–2.11 s to roughly 0.15 s.

Faster authenticated app

The scan and substrate APIs now run in the same region as the database, removing roughly 200 ms of cross-region latency from every request, and the dashboard's charting library loads on demand — cutting its initial JavaScript by 39%.

Trends aggregate across the whole organization

Trend series now combine every project in an organization and exclude runs that never produced a score, so the timeline reflects real movement instead of gaps from a single repository.

Free until September 30, 2026

The pricing page now states plainly that VibeCop is free through September 30, 2026 — shown in a banner, in the FAQ, and in the page description.

Deployment topology view

The graph screen's TOPOLOGY tab now draws deployable services, databases, and external dependencies as a system diagram — replacing a view that only mirrored the repository's directory tree.

Modernized interface across the app

Dashboard, findings, pull requests, graph health, repositories, scans, agents, and settings all moved onto one component kit — a shared glass shell, consistent severity and status treatments, and a hardened light/dark palette with contrast and keyboard fixes throughout.

Graph modules reflect real architecture

Module groupings are now prefixed by the workspace unit they belong to, so each service keeps its own routes and services instead of collapsing into one shared group, and imports written with path aliases or workspace package names now resolve into real edges.

Architecture Integrity axes score from recorded findings

Each axis score is now computed from the axis stored on every finding rather than inferred from rule names. Axis tiles that previously read near-perfect regardless of what a scan found now move with the findings behind them.

Detector agents completed their Phase A rewrite

Pattern drift, reintroduced bugs, semantic duplication, reinvented utilities, hallucinated abstractions, over-engineering, architectural complexity, layer violations, orphaned modules, and dependency health were each rebuilt on deterministic evidence — graph grounding, structural suppression of false positives, and fault isolation so one failing agent no longer loses a scan's other findings.

Source code and Ask conversations encrypted at rest

The two stores that hold verbatim customer text — extracted source snippets and Ask thread messages — are now encrypted with AES-256-GCM before they are written, with existing rows backfilled.

Self-serve data export and organization deletion

Organizations can now export their data and delete themselves from settings, with a 48-hour grace window before anything is removed and an app-wide banner while a deletion is pending.

Graph timeline and AI summary

The graph screen now plots a real series from stored snapshot history instead of a placeholder, and opens with a generated summary of what changed in your architecture.

Live scan progress

Running scans now surface as they happen — a live banner on the scans view, a per-detector activity strip showing which agents are working, and rescan progress on the dashboard instead of a silent wait.

Unified activity feed

Scans, graph extractions, and background jobs now share one activity feed, with unread counts on the navigation so finished work is visible without checking each screen.

Docs sidebar, MCP guide, and open demo

Documentation gained persistent sidebar navigation and a dedicated MCP page, and both the demo and the evaluation sandbox are now open to visitors without an account.

Infrastructure-as-code checks expanded

IaC misconfiguration scanning grew to 22 rules across Terraform, Dockerfile, Kubernetes, and CI workflow files.

Secret detection expanded

Hardcoded-secret scanning grew from 6 to 23 detection patterns, covering GitHub, AWS, GCP, Slack, Stripe, private keys, and more, with severity per pattern.

Whole-repository scanning

Scans and graph extraction now read the entire repository from a single tarball snapshot instead of sampling per-file — per-scan file caps removed, bounded only by repository size limits.

First scan starts automatically

Connecting a repository now offers a one-click "Run first scan + graph?" prompt, so the first Architecture Integrity Index arrives without hunting for a scan button.

Simpler repository model

Each codebase now maps to exactly one GitHub repository, and disconnecting archives it — removing the intermediate repo tier entirely.

Plan Review MCP consolidated to four skills

The Plan Review MCP now exposes four focused skills with updated credit costs, replacing the earlier larger skill set.

Graph drill-in navigation

The full code graph now supports drill-in navigation with a layered layout, labeled edges, and a scope filter — making it easier to trace dependencies and calls across a large repository.

VibeCop UI overhaul

A refined interaction layer across the whole app: consistent severity tokens on findings, a retuned surface-ramp, and an exploratory graph view for browsing your codebase's structure.

Org-level wallet

Credits and billing are now consolidated at the organization level, replacing the earlier per-product setup — one balance and one subscription per organization.

SAST detector expanded

The static application security testing layer grew from 5 to 18 rules, each with its own severity, CWE and OWASP tags, real line numbers, and full-tree scanning instead of a sample.

Dependency-CVE detector v4

Dependency vulnerability scanning moved to two-phase OSV lookups with CVSS scoring, lockfile transitive-dependency resolution, and EPSS plus CISA KEV enrichment for prioritizing real-world exploit risk.

Detector blackboard

Detector agents now share extracted graph facts on a common bus, so later agents in a scan can build on what earlier agents already found instead of re-deriving it.

Graph edge confidence and architectural hubs

Every graph edge is now tagged extracted or inferred based on how it was resolved, and the graph health view surfaces architectural hub candidates — nodes with unusually high fan-in or fan-out.

AI fix prompts

Every finding now gets a copyable, LLM-generated fix prompt you can hand directly to your coding assistant, instead of writing the fix instructions yourself.