Transcription
If you vibe code with Cloud Code, Codeex, or any other vibe coding tool, there's a really good chance that your sensitive data has already been leaked on accident when you ship something. Because when an AI agent ships fast, it hardcodes your API keys, drops passwords straight into your files, and leaves security holes like SQL injections literally wide open. And then it commits all that to GitHub for the world to see and take advantage of.
But don't panic because in this video I'm going to show you a new AI tool called Rafter that can catch every single one of these mistakes before you ever ship code. It connects to your GitHub, scans your entire codebase in just one click, and hands you your fixes in plain English so that you could hand them to your agent and get them fixed immediately. And the part that matters the most is you could wire this directly into Cloud Code. So it blocks any vulnerabilities that you might have the moment that your agent goes to write them. So, let's dive right into exactly how you could set this up and five crazy use cases you could use this for.
Now, that brand new AI tool that I'm talking about is going to be Rafter right here. And this is not only insanely useful, it's also really easy to get set up. And the use cases I'm going to show you here are pretty crazy. So, once you actually get signed up right here, you can see that this will actually check your code for vulnerabilities, secrets, credentials, insecure dependencies, code quality, and AI.
As we go through here next, we can see that getting started with this is literally as simple as just copying this right here and then opening up Cloud Code or wherever you're going to be coding and then pasting this in here. Now, this is actually going to go through, this is going to walk you through everything that you need to do in order to actually set this up here. And then what I actually did here that I think is actually a nice touch is I say to it, I want to run this on all future projects. And it actually updates the config skill right here to actually go through and add this automatically into all of them so that it'll always run. And now we can see that this is literally going to run every single time that I go to actually code something with Cloud Code.
In addition to that, you can connect it right here directly to your GitHub repo URL. Or if you're using Replit, Bolt, Cursor, Base 42, you can do it with that too. Then you could literally choose exactly what repository you want to run a scan on, what branch, and if you don't see any, you could manage your access or reauthorize it, and it will go through and scan for you. For example, I have this example that I'm going to have this run through. We're going to click on start scan, and now it's actually going to go through, and it's going to do it.
As we could see right here, we could also again get this to actually run on any coding agent that we're using by just copy and pasting this, putting it in here, and then giving it our Rafter API key. And now just like that, we could see that this is now going through and this is running a scan right here for this repository. We could see the status, we could see what mode, we could see the date and time. And this is now going through and going to show us any actions. And if we wanted to, we could also run a plus run. But personally, I'm just running a fast run on this.
Now, in addition to running a security scan on any type of code that you have, you could also do this directly on the site. We can see that we could actually create a project right here where we're going to be able to manage live projects and their security, best practices, SEO, DNS, speed, accessibility, and more, all incredibly easily. In order to get started with this, we're literally just going to come over here and we're going to paste in a domain URL. For example, baseballism.com. We're going to click on create project. And now, this is literally going to go through and we can walk through exactly what pages we want to monitor. We can run our first scan right here. And then we're going to be able to see everything. So, personally, I really just want to monitor the homepage right here. I'm going to click on run our first scan. And now we can see that we also have a scan running for this website. Now, I would strongly suggest that you go through and actually run this on every single live URL that somebody's going to be able to access on your page. But we can see this is now going through. It's got the text stack. It's doing a flight test. We have hygiene check. We have a security check, a DNS check. And this would be done in just a few minutes.
Now, if we actually come back over here, we could see that this other scan is done on the code right here. Happened really fast. If we actually come over here, we could see that this goes through and gives us a security score of 100 out of 100. Goes through all the secret detections, fundamentals, AI infrastructure, and it also says we have no critical errors, no warnings, and no improvements. Now, this is because I've literally already gone through and hand-checked this example that I showed right here. But in a little bit, I'm going to show you what it looks like when you don't do that and just how many things this actually finds. And what's pretty crazy is that when it does find something, it'll show you the exact file, the exact line, and exactly how to fix it with plain English. So, you don't have to be a coding expert in order to fix it. And if we actually come back over to the website that we had to check, we could see that we have eight things that passed. We have one warning. We have zero failed right now and five information. If we come down here, this literally gives us the exact prompt that we copy in order to get AI to fix this for us, which is pretty insane.
Now, before I show you the five ways that I'm currently using this, I wanted to remind you that AppSumo is having a lifetime deal for this tool right now. You could grab it today for 70% off. So, it's literally only $39 one time instead of $180. And that's lifetime access. On top of that, they have a 60-day refund policy. So you can use it to scan your repos, see what it catches, and decide whether or not you like the tool with zero risk.
Now, use case number one that I wanted to show you is actually how you can get this to scan your entire repo right here. So we can see we have a repository right here, and we have this specific branch, or we could just do the entire repository. I'm going to click on start scan, and now this is going to go through, and this is actually going to check a new landing page that I was going to go ahead and actually have created here and actually get pushed to my GitHub right here. And we could see that inside of the main branch right here on a different repository. So it has access to everything that's on my GitHub. We're using fast mode. Again, we have the status, the date, the time. And once this is done, we're going to be able to view the report. And this works for both public and private repos. So don't just think that it has to be something that's out there in the public. In fact, one AppSumo user actually ran this after getting Rafter and they found that there were API keys, secrets, passwords, a bunch of things leaked on a website that had been live for months. And you might have the same mistake because this is literally going to catch all of that for us.
Now, from here, I could see my score, which is pretty low on this one, of 47. We could see secret detection was fine, fundamentals is not good, AI was fine, and infrastructure was also fine. We now have all of these critical errors, warnings, and improvements. And if we literally just click on copy for AI, that will then give us the exact prompt that we then go use on Codeex or Claude in order to actually fix this.
The second use case is let's say that we're building something out inside of Cloud Code. For example, I'm asking it to create a new landing page for a coffee shop that I'm working on. This is going to go through, ask me a few questions. It is then going to code this up. And what we'll actually be able to do is drop Rafter directly in here like I showed you earlier. And then guess what? This is actually going to be able to catch any vulnerabilities or anything wrong with the code before we ever push it to GitHub. Now we can see that this has actually gone through and this has created the HTML right here. It's then going to go through and it is going to add in all the different CSS. And now I just ask it to run a Rafter scan to make sure there aren't any vulnerabilities. It is going to load up that skill and everything else that it has and it is now going to run it through this. Now it did just need that key in order to actually set this up. So I gave it to it. So now we have our entire security assessment right here, which is pretty awesome. And again, since you're using this inside of your coding agent, there's basically no way that you're going to accidentally leak something before it ever gets put anywhere, it's being checked.
Now, use case number three is how you're able to literally just hand this off directly to your coding agent. We could see right here that if we simply just click on copy prompt, and then we actually come over into our coding agent. Look at this entire prompt that they just went through and did. You are a cybersecurity engineer and full-stack developer. Analyze a security finding from an automated Rafter audit on this website right here. It literally goes through everything, goes through what its task is and be direct and actionable. So, this literally turns whatever coding agent you have into a cybersecurity expert in order to actually be able to fix, be able to change, be able to uncover issues inside of its own code. And this is incredible because as we can see right here, they literally have this for several different things. Like this one right here, we could see the same exact thing. If I come back over here and type this one in, this is a little bit different. This is going to be around Superbase. Goes through all the context, gives it its task. And this right here is incredible again because it takes the prompt engineering out of what you're doing. It takes any type of messing up out of what you're doing. Doesn't even require you be a coding expert, which let's be honest, most people that are going through and using these AI agents, especially AI coding agents, aren't experts at this. It might accidentally be leaking stuff. That's probably you. And this right here literally solves every problem you could think of.
Which brings me into use case number four, which is actually again something that I showed you earlier, which is how you could actually have this go through and run live scans on whatever website you want. It's literally as simple as you coming over to dashboard right here under sites. You want to click on this. Then you'll click on add project. You'll just simply add in whatever the URL is. And this allows you to get your full audit, everything. You could change all of that without even accessing the code. And if you have live websites, I would strongly suggest that you go through and do this to be able to see if there are any mistakes when it comes to security, best practices, SEO, DNS, speed, accessibility, and more.
Then that last use case you could actually use this for is something that's going to affect everybody. Even if you're not coding, if we come over here into customize, what you were going to notice is that you can add in different skills to Code. Most people just grab skills from the internet or from something that they found and then they upload them or download them into their instance. We can see that you could do that right here literally just by coming over here to create skill. Upload a skill. Even if you created a skill with Code, there might be security things in there. And guess what? There might be vulnerabilities in there. But now you could actually point Rafter at these different skills in order to figure out exactly what's wrong with them, what information you might be giving up, and it will warn you of anything that you want to change. In addition to that, it also literally just allows you to fix it directly in here because you could rewrite any of these skills anytime you want. Because if you remember, a bad skill or a skill that is going to be something that you don't want on your computer has access to all of your local different files, which can become incredibly dangerous if you're just downloading random skills from the internet. And I think that this is going to be one of the most talked about things in 2026, especially as we go into 2027, because what you're noticing is everybody's using skills now. Gemini is using skills, Claude's using skills, ChatGPT has skills, and people are just going to be randomly installing this into their instance, which might have access to their local files to sensitive information. And you never know what those skills might be gathering, where they're sending it, or what modifications they might be making.
So, here's the honest truth. AI coding agents are incredible, but they ship fast and they ship sloppy. And the security gap is definitely a real one. And Rafter is the layer that'll sit between your agent and your repo and it makes sure that nothing leaks through that might end up getting you in trouble. If you do most your work in Cloud Code or Codeex, this is not even a debate. You need to go to the pin comment below and get started with Rafter today because right now AppSumo has a lifetime deal and it's only $39. You're getting this for 78% off and it's refundable for 60 days if you try it out and realize you don't like it. So, what are you waiting for? Go to that pin comment below and get started with it.