VibeGuard 🛡️

Security scanner for vibe-coded apps. Finds AI-generated security flaws and gives you the prompt to fix them.

Built for developers who use AI to write code but want to make sure it's actually secure.

Quick Start

npx vibeguard scan

That's it. Run it in any project folder.

What It Checks

| Rule | What It Catches | |---|---| | 🔑 Exposed Secrets | API keys hardcoded in frontend code (Stripe, Supabase, OpenAI, GitHub) | | 🔓 Missing RLS | Supabase tables without Row Level Security | | 🚪 Missing Auth | Backend functions with no authentication | | 💳 Price Trust | Stripe checkout accepting prices from the client | | 📁 Env in Git | .env files not in .gitignore | | 🌐 CORS Wildcard | Unauthenticated APIs accepting requests from any website | | 💉 SQL Injection | User input concatenated into database queries | | 🔗 Insecure HTTP | API calls using http:// instead of https:// |

Example Output

SECURITY SCORE: 0/100

CATASTROPHIC  Exposed Stripe Live Secret Key in frontend code
File: client/App.tsx:3

Prompt to fix (copy & paste into your AI):
---------------------------------------------
I have a Stripe Live Secret Key hardcoded in my frontend
file. Please move this to a backend Edge Function and use
an environment variable instead.
---------------------------------------------

Every finding comes with a copy-paste prompt you can drop straight into ChatGPT, Claude, or Cursor to fix it.

Why VibeGuard?

AI writes code fast. But it also writes code that:

• Puts secret keys in your frontend
• Creates database tables anyone can read
• Builds checkout pages where hackers can pay $1 for a $100 product
• Forgets to check if someone is logged in

You wouldn't know. VibeGuard would.

License

MIT