VibeGuard Local 🛡

Free, offline security scanner for your code — catch leaks before you ship.

Built AI-generated an app and not 100% sure it's safe to deploy? VibeGuard Local scans your repo on your machine (nothing leaves your laptop) for hardcoded secrets, committed .env files, and the risky patterns AI codegen loves to produce. It grades your repo A–F in ~5 seconds.

This is the local companion to VibeGuard (which scans your deployed site). The two share the same secret-detection and grading engine.

Quick start (5-second install)

# no install — just run it in your project
npx @thkimsw98/slopscan scan .

# or clone & run
node cli.mjs scan <dir>

Example:

node cli.mjs scan ./my-app

What it catches

Secrets (high confidence)

• Hardcoded API keys: OpenAI, Anthropic, Stripe, AWS, Google, GitHub, Slack
• Private key blocks (-----BEGIN … PRIVATE KEY-----)
• Committed .env files that contain real-looking values (not placeholders)

AI-slop patterns (heuristic — see caveats below)

• eval() / new Function()
• SQL built by string concatenation or template literals (SQL-injection shape)
• dangerouslySetInnerHTML (XSS shape)
• child_process exec/spawn with interpolated input (command-injection shape)
• Permissive CORS (Access-Control-Allow-Origin: *)
• Hardcoded passwords / Basic-auth headers

Each finding shows a file:line and a one-line how-to-fix.

Output & CI

• Colorized terminal report grouped by severity, plus an A–F grade and score.
• --json for machine-readable output.
• Exit code is non-zero when the grade is worse than the threshold, so it drops straight into CI:

node cli.mjs scan . --fail-under=B   # fail the build below a B

Options:

| flag | meaning | |------|---------| | --fail-under=<grade> | exit non-zero below this grade (default C) | | --json | machine-readable output | | --no-color | plain text |

It respects .gitignore and skips node_modules, .git, dist, .next, build, etc.

Silencing false positives

Heuristics misfire sometimes. Three escape hatches, cheapest first:

• Per line — add // vibeguard-ignore anywhere on the line:

  el.innerHTML = trustedTemplate; // vibeguard-ignore

• Whole files/dirs — create a .vibeguardignore (same glob syntax as .gitignore):

  test/
  legacy/vendored.js

• Automatic — lines that contain a regex literal are treated as pattern definitions (linter configs, scanner rule lists, this tool's own source) and skipped, so security tooling doesn't flag itself.

Caveats (it's a spike)

The AI-slop checks are heuristics, not a real dataflow analysis. They match on the shape of code, so they can misfire:

• A template-literal SELECT that only interpolates a constant is flagged even though it's safe.
• dangerouslySetInnerHTML with already-sanitized HTML is still flagged.
• The regex-literal skip means a genuine vuln sharing a line with a /regex/ is missed (rare).

Treat heuristic findings as "look here," not "definitely broken." Secret detection is much higher-confidence (strict key formats + a digit/letter check to drop dictionary words).

Tests

npm test   # asserts planted issues are caught (grade F) and clean code passes (grade A)

Roadmap — paid tier (not built here)

Future paid tier for teams: a CI dashboard (trend of grade over time across repos), continuous monitoring / PR checks, org-wide policy, and org secret-rotation tracking. The CLI stays free as the top of the funnel. No payment code is included in this spike.

License

MIT