QASS

QA + Security Scanner for vibe-coded apps.

Your AI writes code. QASS catches the security holes, broken flows, and silent failures it left behind — before your users do. Works with Cursor, Windsurf, Copilot, and any AI editor.

Install

npm install -g qass

Or run without installing:

npx qass scan --project .

Quick Start

# Initialize config in your project
qass init --project .

# Run a full security scan
qass scan --project . --full

# Run tests based on your latest git changes
qass test --project . --diff HEAD

What It Catches

Free

• 7 static security rules — missing auth middleware, SQL/NoSQL injection, hardcoded secrets, XSS vectors, CORS misconfiguration, rate limiting gaps, dependency CVEs
• Basic smoke crawl — page load verification, console error detection
• Endpoint discovery — auto-detects Express routes
• Git diff analysis — only scans what changed
• AI-readable reports — structured for your AI editor to read and fix

Pro

• Full smoke crawl — clicks every button, fills every form, catches silent failures
• Visual regression — pixel-diff screenshots against baselines
• Flow testing — multi-step user journeys defined in YAML
• API testing — auth, plan gating, response validation with Supabase support
• Dynamic security probing — tests live endpoints for error disclosure, missing headers

How It Works With AI Editors

QASS generates a rule file that tells your AI editor to run tests after every code change:

# Generate a Cursor Rule
qass cursor-rule --project .

# Creates .cursor/rules/qass.mdc

The rule instructs your AI to:

1. Run qass test after making changes
2. Read the report at .qass/results/latest.md
3. Fix every finding (each has exact file, line, and fix instructions)
4. Re-run until clean
5. Only then tell you it's done

This works with any AI editor that can run terminal commands — Cursor, Windsurf, Copilot, Bolt, Lovable.

Configuration

QASS uses a .qass/config.yaml file in your project root:

project:
  name: my-app

services:
  api:
    framework: express
    entry: src/server.ts
    port: 3001
  frontend:
    framework: nextjs
    port: 3000

security:
  static_rules:
    - auth-middleware
    - input-sanitization
    - secrets-scan
    - xss-vectors
    - config-audit
    - rate-limit-audit
    - dep-audit
  severity_threshold: LOW

paths:
  api_routes: "src/**/*.routes.ts"
  middleware: "src/middleware/**"
  frontend_pages: "app/**/page.tsx"
  components: "components/**/*.tsx"

Run qass init to generate a default config.

CLI Commands

| Command | Description | |---------|-------------| | qass init | Initialize .qass/config.yaml in your project | | qass scan | Run security scan only | | qass test | Run full test suite (security + API + E2E + unit) | | qass discover | List discovered endpoints, pages, and accounts | | qass cursor-rule | Generate AI editor rule file | | qass activate <key> | Activate a Pro/Team license | | qass status | Show current license and plan info |

Reports

QASS generates reports in two formats:

• .qass/results/latest.json — machine-readable, for programmatic use
• .qass/results/latest.md — human/AI-readable, with fix instructions

Each finding includes:

#### MEDIUM: input-sanitization — routes/contacts.ts:6
**Issue**: Unsanitized user input passed to .filter()
**Fix**: Use a sanitization function: const q = sanitize(req.query.q);

Requirements

• Node.js >= 20.11.0
• Git (for diff analysis)
• Playwright (optional, for E2E testing): npm i -D playwright
• Vitest (optional, for unit test generation): npm i -D vitest

License

Proprietary. See LICENSE for details.

Free tier available. Pro and Team require a license key — see qass.dev for pricing.