AllSafe VibeGuard

AllSafe VibeGuard is a local semantic security deployment gate for JavaScript and TypeScript projects generated or modified with AI tools. It combines focused secret detection, AST inspection, and scope-aware data-flow analysis to report high-risk implementation mistakes before deployment.

The scanner runs locally, does not upload source code, and is designed to fit into developer workstations and CI release checks. VibeGuard detects risky outcomes commonly found in quickly generated code; it does not attempt to determine whether a human or an AI authored the code.

What's new in 0.2.0

• AST analysis for JavaScript, TypeScript, JSX, and TSX through Babel
• Scope-aware taint tracking from request input through variables to dangerous sinks
• Compact source-to-propagation-to-sink traces for data-flow findings
• Detection of fail-open handlers and placeholder authorization checks
• Detection of incomplete JWT validation, unsafe session cookies, and credentialed wildcard CORS
• Detection of predictable security values created with Math.random()
• Detection of unfinished security TODO and FIXME controls
• Focused checks for SSRF, SQL injection, command injection, path traversal, and dynamic execution
• Reduced false positives for unrelated functions, CSRF cookies, and ordinary UI randomness

Version 0.2.0 is the first stable release of the semantic analysis engine. It remains a focused deployment gate rather than a replacement for code review, dependency auditing, penetration testing, or a complete SAST platform.

Quick start

Node.js 20 or newer is required.

npx @all-safe-projects/allsafe-vibeguard scan .

The scanner reads the selected local directory. It does not upload project source code.

CLI

allsafe-vibe scan [path] [options]
allsafe-vibe [path] [options]

Options:
  --json                  Print JSON
  --fail-on <severity>    critical, high, medium, low, none
  --no-color              Disable terminal colors
  --max-files <count>     Override the 10,000-file safety limit
  --max-total-mb <mb>     Override the 25 MB content safety limit
  --timeout <seconds>     Override the 30-second safety limit
  -h, --help              Show help
  -v, --version           Show version

Examples:

npx @all-safe-projects/allsafe-vibeguard scan . --fail-on medium
npx @all-safe-projects/allsafe-vibeguard scan ./services/api --json
npx @all-safe-projects/allsafe-vibeguard scan . --max-files 50000 --max-total-mb 150 --timeout 120

The default failure threshold is high. Exit code 0 means the configured threshold was not reached, 1 means it was reached, and 2 means the scan could not complete.

Current checks

• Embedded private keys and credentials shaped like AWS, GitHub, or Stripe secrets
• Hardcoded passwords, tokens, API keys, and sensitive .env files
• Predictable security-secret fallbacks and JWT decoding without signature verification in the same control scope
• Incomplete JWT trust checks and authentication cookies missing defensive attributes
• Unconditional authorization stubs, unfinished security controls, and fail-open exception paths
• Predictable randomness used for tokens, sessions, reset codes, or similar security values
• Credentialed wildcard CORS configurations
• Request data flowing through local variables into SSRF, command execution, SQL, filesystem, or dynamic-code sinks
• Disabled TLS certificate verification and other focused dangerous-code patterns

Each finding includes severity, confidence, analysis engine, evidence with common credentials redacted, impact, and a remediation suggestion. Data-flow findings also contain a compact source-to-sink trace.

Example trace:

source       server.ts:8   Untrusted HTTP input: req.query.url
propagation  server.ts:9   Value propagated through destination
sink         server.ts:10  Dangerous operation: fetch

Why VibeGuard

Dependency auditors answer whether installed packages have published vulnerabilities. Secret scanners answer whether credentials look committed. VibeGuard instead focuses on security controls that appear complete but are unsafe in implementation: verification without pinned trust claims, placeholder authorization, fail-open handling, predictable security values, and request data reaching dangerous APIs.

The scanner runs locally and does not upload source code. AST parsing is used for JavaScript, TypeScript, JSX, and TSX; text patterns remain available for configuration and secret-bearing files.

Verdicts

| Verdict | Meaning | | --- | --- | | PASS | No findings were detected by the current rule set. | | REVIEW | One or more low or medium findings require review. | | BLOCK | One or more high or critical findings were detected. |

Programmatic API

import { scanProject } from "@all-safe-projects/allsafe-vibeguard";

const result = await scanProject(".");
console.log(result.verdict, result.findings);

Optional resource limits can be overridden for controlled environments:

const result = await scanProject(".", {
  limits: {
    maxFiles: 5_000,
    timeoutMs: 15_000
  }
});

Default limits protect the scanner from unexpectedly large or hostile directory trees: 10,000 files, 5,000 directories, depth 30, 25 MB total scanned content, 1 MB per file, 1,000 findings, and 30 seconds. Exceeding a limit stops the scan with exit code 2; it does not silently return an incomplete result.

Limitations

The data-flow engine is scope-aware but intentionally lightweight. It does not yet provide complete inter-file or framework-aware reachability analysis. VibeGuard can produce false positives and false negatives, and a PASS result is not proof that an application is secure. Review findings in context and use layered security testing before production deployment.

Security reports

Report vulnerabilities through the All Safe Areas vulnerability disclosure page.

License

This package is proprietary and distributed as UNLICENSED. Limited internal-use rights and restrictions are stated in LICENSE.