🛡️ VibeGuard

The ultimate security scanner for AI-generated code.

AI coding assistants are great, but they sometimes introduce subtle security vulnerabilities. VibeGuard is a fast, lightweight, and configurable CLI tool that acts as your final defense line, scanning your codebase for secrets, SQL injections, missing authentication, and more.

Features

• Fast & Lightweight: Built in TypeScript, using regex and heuristics.
• AI-Focused Detectors: specifically targets vulnerabilities often introduced by LLMs.
• Secrets Detection: Finds AWS keys, GitHub tokens, passwords, and other hardcoded secrets.
• SQL Injection Detection: Detects string concatenation and unparameterized queries.
• Auth Checking: Highlights sensitive routes missing authentication middleware.
• Scoring System: Gives your project a "Vibe Code Safety Score" from 0 to 100.
• CI/CD Ready: Export reports in JSON or SARIF for seamless integration.

Installation

You can run VibeGuard instantly using npx, or install it globally/locally.

# Run without installing
npx vibeguard scan .

# Install globally
npm install -g vibeguard

# Install as a dev dependency
npm install -D vibeguard

Usage

Basic Scan

Scan the current directory:

vibeguard scan .

Scan a specific directory and fail if the score drops below 80:

vibeguard scan src/ --fail-below 80

Configuration

Initialize a default configuration file in your project:

vibeguard init

This creates a .vibeguard.yaml file where you can customize the scanner:

minSeverity: low
scoreThreshold: 50
ignore:
  - "**/node_modules/**"
  - "**/.git/**"
  - "**/dist/**"
  - "**/build/**"
  - "**/*.min.js"
extensions:
  - ".js"
  - ".ts"
  - ".jsx"
  - ".tsx"
  - ".py"
  - ".json"
  - ".yaml"
  - ".yml"
  - ".env"
maxFileSize: 1048576
detectors:
  secrets: true
  sql: true
  auth: true
  files: true
outputFormat: text
showBadge: true

Git Hooks

Prevent vulnerable code from being committed by installing the pre-commit hook:

vibeguard hook install

To remove the hook:

vibeguard hook uninstall

Integrating with GitHub Actions

VibeGuard includes a composite GitHub Action that you can easily drop into your workflows.

Create a .github/workflows/vibeguard.yml file:

name: VibeGuard Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      
      # Use the VibeGuard Action
      - name: VibeGuard Scan
        uses: ./action
        with:
          path: '.'
          fail-below: '70'

License

MIT License. See LICENSE for details.