Findings feed
What's been flagged across vibe-coded apps.
A live, anonymized record of every finding the scanner emits across public scans. Rule, severity, platform shape, timestamp — no URLs, no host names, no PII. 14-day rolling window.
What we persist, exactly.
Per finding: rule (the rule name, same as /fix/<rule>), severity (one of critical, high, medium, low, info), ts (unix seconds), and platformShape (one of *.pages.dev, *.vercel.app, *.bolt.new, *.netlify.app, *.fly.dev, *.workers.dev, *.replit.app, *.lovable.app, *.firebaseapp.com, or a generic *.tld / custom fallback).
What we never persist: full URLs, host names, response bodies, request bodies, IP addresses, user identifiers. Vibecheck's own self-scans are excluded so the feed isn't dominated by dogfooding. Per-scan cap: 8 most-severe findings.
Rows expire after 14 days via Cloudflare KV TTL. The endpoint at /api/feed?limit=N (cap 50) is public CORS — agents and dashboards can ingest it.