🐧 penguin-audit

"Your AI code passed the vibe check. But will it pass production?"

A CLI tool that scans vibe-coded repositories for security vulnerabilities — no AI model required, no API key needed for the free scan.

Quick Start

# Free scan — no signup required
npx penguin-audit

# Scan a specific directory
npx penguin-audit --dir /path/to/your/project

# Get a free API key for full AI-powered scan
npx penguin-audit --get-key

# Full AI scan — opens Project Penguin dashboard
npx penguin-audit --full

What It Detects (Free, No Key)

🔴 Hardcoded Secrets

• AWS, GCP, Azure credentials
• GitHub, GitLab tokens
• Stripe, PayPal, Twilio keys
• OpenAI, Anthropic, Gemini API keys
• Database connection strings with passwords
• JWT secrets
• 30+ secret types using TruffleHog-style patterns
• Shannon entropy detection for unknown secret formats

👻 Phantom Dependencies

• Packages that don't exist in npm registry (AI hallucinations)
• Newly published packages with suspiciously low downloads
• Known CVEs via OSV.dev (free, no key needed)

💉 Prompt Injection Risks

• User input flowing directly into AI prompts
• System prompt concatenation vulnerabilities
• Unvalidated template literals in AI API calls

What You Get With Full Scan (Free API Key)

• CVSS 3.1 scores for every finding
• CWE + OWASP Top 10 mapping
• GDPR article mapping
• SOC2 criteria mapping
• AI-generated copy-ready fix prompts
• Live courtroom dashboard with Judge Penguin

Install Globally (Optional)

npm install -g penguin-audit
penguin-audit

How It Works

npx penguin-audit
       │
       ├── Layer 1: Find all source files (skips node_modules, dist, etc.)
       ├── Layer 2: Scan each file with regex + entropy for secrets
       ├── Layer 3: Check all imports against npm registry + OSV.dev
       ├── Layer 4: Detect prompt injection patterns in AI-calling code
       └── Verdict: GO / CONDITIONAL GO / NO-GO

No AI models. No API calls. Pure deterministic scanning. Same input = same output. Always.

Built By

Project Penguin — Production readiness scanner for vibe-coded apps.