Changelog

Security improvements. Ongoing hardening across the platform.

Deploy large sites from the browser. Drag-and-drop uploads over 95 MB now go up file by file instead of as one archive, so a site only has to fit the 500 MB total rather than squeeze into a single request. Files you've uploaded before are skipped, so re-deploying a mostly-unchanged site transfers far less. Individual files are still capped at 100 MB.

Drop a folder anywhere to deploy it. The dashboard accepts a drag-and-drop deploy from the apps list, an app page, or the Create dialog — no CLI needed for a first deploy.

The Chrome extension also gets a redesigned popup with dark mode and onboarding, and can deploy a canvas straight from the popup.

Secrets are left out of your deploy. .env files, private keys, and similar sensitive paths are now excluded from static and skill deploys automatically. If your site genuinely needs one of those files at runtime, pass --include-sensitive <paths> — otherwise it won't be in the upload.

Team members hub. Manage members and their roles from one page instead of hunting through workspace settings.

Folders — organize your apps. Group apps into folders, with their own sidebar tab and a visibility filter; Starred is now its own tab. Move apps between folders from the dashboard, the CLI, or MCP. Sharing is still per-app — a folder groups apps, it doesn't grant access to them.

Rolling out gradually: folders are enabled per workspace.

Comments you can hold a conversation in. Mention teammates with @ and they get a notification and an email. You can edit, move, and delete your own comments, and reply without leaving the dashboard.

Secret scanning on deploy. VibeHost checks your files for what look like leaked API keys and stops the deploy before anything ships. Override with --allow-secrets when it's a false positive.

Sessions also expire sooner — access tokens 30 days → 24 hours, refresh tokens 90 days → 30 days. The CLI refreshes in the background, so day-to-day use is unaffected. If you set VIBEHOST_TOKEN in CI, switch to a personal access token — a session token now expires after 24 hours. vibehost doctor warns when it sees one.

CLI v4.9.0 — work through comments from the terminal. vibehost comments pull fetches open feedback on a deployed app, and vibehost deploy --resolves <ids> marks those threads addressed as soon as the fix goes live. Built for coding agents doing a review-fix-redeploy loop.

Notifications. Deploy results and access requests now reach you in the dashboard instead of going unannounced, and each row links straight to whatever it's about. Comment and mention notifications followed in early July.

Extension v1.2.0 — App display name and description metadata now syncs across the Chrome extension, CLI, dashboard, and API.

CLI v4.8.0 — Big release:

• Node runtime — deploy plain Express/Node.js apps, not just static sites and Next.js.
• Neon managed Postgres — one-click free database for your app.
• Upstash Redis — provider-agnostic managed storage layer.
• Comment mode — pin feedback directly on live deployed apps.
• App metadata — set display name and description on your apps.
• Monorepo support — server builds now work with pnpm workspace monorepos.
• Custom build commands — configure install/build commands via vibehost.json.

VibeHost is live. The platform, CLI, and API are generally available — deploy a static site to a private URL in seconds. See the quickstart to get going.