CONNECT SCANMYVIBE
TO YOUR ENTIRE STACK.

# 1. Search for @ScanMyVibeBot on Telegram
# 2. Click "Start" or type:
/start

# 3. Pair your account with your pairing code from your ScanMyVibe dashboard:
/link YOUR_PAIRING_CODE

// Example payload delivered to your #security Slack channel:
{
  "text": "🚨 *CRITICAL VULNERABILITY DETECTED* on https://myapp.com",
  "attachments": [{
    "color": "#ef4444",
    "fields": [
      { "title": "Issue", "value": "Supabase users table public with RLS disabled", "short": true },
      { "title": "CVSS Score", "value": "9.8 (Critical)", "short": true },
      { "title": "Action", "value": "<https://scanmyvibe.co/results/xyz|View AI Fix Prompt>", "short": false }
    ]
  }]
}

name: ScanMyVibe Security Gate
on: [push, pull_request]

jobs:
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger ScanMyVibe Security Scan
        run: |
          RESPONSE=$(curl -s -X POST https://scanmyvibe.co/api/v1/scan \
            -H "Authorization: Bearer ${{ secrets.SCANMYVIBE_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{"url": "https://staging.myapp.com"}')
          
          SCORE=$(echo $RESPONSE | jq '.score')
          echo "Scan completed. Security score: $SCORE/100"
          
          if [ "$SCORE" -lt 70 ]; then
            echo "❌ Security score $SCORE is below threshold of 70!"
            exit 1
          fi

// claude_desktop_config.json or cursor settings:
{
  "mcpServers": {
    "scanmyvibe": {
      "command": "npx",
      "args": ["-y", "@scanmyvibe/mcp-server"],
      "env": {
        "SCANMYVIBE_API_KEY": "YOUR_API_KEY"
      }
    }
  }
}

// Verify incoming webhook in Next.js / Express:
import crypto from 'crypto'

export async function POST(req: Request) {
  const signature = req.headers.get('x-scanmyvibe-signature')
  const body = await req.text()
  
  const expected = crypto
    .createHmac('sha256', process.env.SCANMYVIBE_WEBHOOK_SECRET!)
    .update(body)
    .digest('hex')
    
  if (signature !== expected) {
    return new Response('Invalid signature', { status: 401 })
  }
  
  const data = JSON.parse(body)
  console.log(`Scan for ${data.domain} finished with score ${data.score}`)
  return new Response('OK', { status: 200 })
}