QASS

QA + Security Scanner for vibe-coded apps.

Your AI writes code. QASS catches the security holes, broken flows, and silent failures it left behind — before your users do. Works with Cursor, Windsurf, Copilot, and any AI editor.

Install

npm install -g @qasshq/qass

Or run without installing:

npx @qasshq/qass scan --project .

Quick Start

# Initialize config in your project
npx @qasshq/qass init --project .
npx @qasshq/qass setup --project .

# Run a full security scan
npx @qasshq/qass scan --project . --full

# Run full QA (security + UI smoke + auto guest flow + API/unit where configured)
npx @qasshq/qass test --project . --diff HEAD

# Open local visualization dashboard (optional)
npx @qasshq/qass ui --project .

What It Catches

Free

• 7 static security rules — missing auth middleware, SQL/NoSQL injection, hardcoded secrets, XSS vectors, CORS misconfiguration, rate limiting gaps, dependency CVEs
• Basic smoke crawl — page load verification, console error detection
• Auto guest journey — follows internal links without any test account setup
• Endpoint discovery — auto-detects Express routes
• Git diff analysis — only scans what changed
• AI-readable reports — structured for your AI editor to read and fix

Pro

• Full smoke crawl — clicks every button, fills every form, catches silent failures
• Visual regression — pixel-diff screenshots against baselines
• Flow testing — multi-step user journeys defined in YAML (optional for deeper auth flows)
• API testing — auth, plan gating, response validation with Supabase support
• Dynamic security probing — tests live endpoints for error disclosure, missing headers

How It Works With AI Editors

qass init automatically generates AI editor integration files for the detected editor context:

# Initialize QASS + auto-generate detected editor integration
npx @qasshq/qass init --project .

For a complete editor integration (config + rule + MCP), run:

npx @qasshq/qass setup --project .

# Optional: force a specific editor target
npx @qasshq/qass setup --project . --editor cursor

The rule instructs your AI to:

1. Run npx @qasshq/qass test --project . --diff HEAD after making changes
2. Read the report at .qass/results/latest.md
3. Fix every finding (each has exact file, line, and fix instructions)
4. Re-run until clean
5. Only then tell you it's done

This works with AI editors such as Cursor, Windsurf, and Copilot-compatible environments.

Configuration

QASS uses a .qass/config.yaml file in your project root:

project:
  name: my-app

services:
  api:
    framework: express
    entry: src/server.ts
    port: 3001
  frontend:
    framework: nextjs
    port: 3000

security:
  static_rules:
    - auth-middleware
    - input-sanitization
    - secrets-scan
    - xss-vectors
    - config-audit
    - rate-limit-audit
    - dep-audit
  severity_threshold: LOW

paths:
  api_routes: "src/**/*.routes.ts"
  middleware: "src/middleware/**"
  frontend_pages: "app/**/page.tsx"
  components: "components/**/*.tsx"

Run npx @qasshq/qass init --project . to generate a default config and auto-create .cursor/rules/qass.mdc.

CLI Commands

| Command | Description | |---------|-------------| | qass init | Initialize .qass/config.yaml in your project | | qass setup | One-command setup: config + auto-detected AI rule + MCP config | | qass prompt | Print copy-paste AI editor setup prompt (--editor) | | qass scan | Run security scan only | | qass test | Run full test suite (security + API + E2E + unit) | | qass doctor | Validate setup and print copy-paste fixes | | qass discover | List discovered endpoints, pages, and accounts | | qass cursor-rule | Generate AI editor integration files (supports --editor) | | qass mcp-config | Generate MCP config (supports --editor) | | qass serve | Start local dashboard server | | qass ui | Start local dashboard and open browser | | qass usage | Show local usage stats for this project | | qass telemetry status | Show telemetry status | | qass telemetry enable | Enable anonymous telemetry events | | qass telemetry disable | Disable anonymous telemetry events | | qass activate <key> | Activate a Pro/Team license | | qass status | Show current license and plan info |

Reports

QASS generates reports in two formats:

• .qass/results/latest.json — machine-readable, for programmatic use
• .qass/results/latest.md — human/AI-readable, with fix instructions

Each finding includes:

#### MEDIUM: input-sanitization — routes/contacts.ts:6
**Issue**: Unsanitized user input passed to .filter()
**Fix**: Use a sanitization function: const q = sanitize(req.query.q);

Usage Dashboard

QASS supports two monitoring modes:

• Local project dashboard: run qass usage to see runs, success/fail counts, and latest findings for the current project.
• Live local dashboard: run qass ui to view runs, findings, screenshots, usage, and license status in a browser.
• Remote telemetry dashboard: set QASS_TELEMETRY_ENDPOINT (and optional QASS_TELEMETRY_WRITE_KEY) to send anonymous usage events to your own analytics backend (PostHog/Mixpanel proxy/etc).

Telemetry can be controlled with:

• qass telemetry status
• qass telemetry enable
• qass telemetry disable

Copy-Paste AI Setup Prompts

Generate an editor-specific prompt you can paste directly into your AI editor:

npx @qasshq/qass prompt --editor cursor --project .
npx @qasshq/qass prompt --editor windsurf --project .
npx @qasshq/qass prompt --editor copilot --project .

Requirements

• Node.js >= 20.11.0
• Git (for diff analysis)
• Playwright (optional, for E2E testing): npm i -D playwright
• Vitest (optional, for unit test generation): npm i -D vitest

Founder Access (Use Full Features Without Paying Yourself)

Use founder keys via Lemon Squeezy (recommended production-safe path):

1. Create an internal Team key in Lemon Squeezy for your own account.
2. Activate it locally:

   qass activate YOUR_FOUNDER_KEY
   qass status

3. Use all features as normal, with real licensing behavior preserved for customers.

Avoid hardcoded bypass flags in production builds.

Release Checklist

Before publishing:

1. npm run build
2. npm test
3. npx tsx src/cli.ts setup --project .
4. npx tsx src/cli.ts doctor --project .
5. npm pack
6. Publish patch version

License

Proprietary. See LICENSE for details.

Free tier available. Pro and Team require a license key — see qass.dev for pricing.