Vibe Audit CLI

Vibe Audit is a production-grade security scanner for modern codebases. It analyzes your application for vulnerabilities, architectural flaws, and business logic risks, then delivers AI-powered remediation guides so your team can ship with confidence.

Vibe Audit is not a linter. It does not flag formatting issues, naming conventions, or stylistic preferences. It exists for one reason: to catch the security flaws, architectural blind spots, and business logic oversights that silently break applications in production.

Where traditional static analysis tools stop at syntax, Vibe Audit goes deeper. It scans your codebase for the vulnerabilities that attackers actually exploit: authentication bypasses, broken access control, payment logic gaps, missing rate limits, unsafe data deletion, N+1 query bottlenecks, and leaked secrets. Every finding is graded by production impact (Critical, High, or Warning) and paired with specific, actionable remediation steps so your team knows exactly what to fix and how.

How It Works

The Vibe Audit CLI scans your codebase using the built-in Core scanning engine, then sends the results to the Vibe Audit platform where an AI-powered analysis pipeline produces context-aware, developer-ready remediation guides for every finding.

Scanner Installation

The CLI automatically downloads and manages the platform-specific core scan engine binary on first run. Binaries are stored locally within the user home directory (~/.vibe-audit-scan/bin/), ensuring zero-config initial setup.

Getting Started

To use the Vibe Audit CLI, you must first create an account on the platform:

1. Visit http://www.vibeauditscan.com to sign up for an account.
2. Run the login command to authenticate the CLI with your credentials.

Prerequisites

• Node.js 22+

Installation

npm install -g vibe-audit-scan

Usage

Run codebase scans

Before running a scan, ensure you are authenticated.

# Scan current directory
vibe scan

# Scan specific directory
vibe scan /path/to/your/project

# Save results to a local file
vibe scan /path/to/your/project -o results.json

Authenticate with Vibe Cloud

# Log in via your web browser
vibe login

# Check active session profile
vibe whoami

# Log out and revoke active tokens
vibe logout

What Vibe Audit Looks For

• Authentication and authorization bypasses
• Insecure Direct Object References (IDOR) and Broken Object-Level Authorization (BOLA)
• Payment, billing, and subscription logic flaws
• Missing or weak rate limiting on critical endpoints
• Leaked credentials, secrets, and API keys
• Unsafe data deletion and missing cascade protections
• N+1 query patterns and database performance risks
• SQL injection, XSS, SSRF, and path traversal
• Race conditions, unhandled edge cases, and memory leaks

What Vibe Audit Does Not Look For

• Code formatting and style preferences
• Naming conventions or variable casing
• Unused imports or dead code
• Indentation, whitespace, or line length
• Any issue that would be caught by ESLint, Prettier, or similar linting tools

Features

• Zero Configuration: The installer automatically bootstraps its own scanning binaries.
• Production-First Analysis: Ignores noise. Surfaces only the flaws that threaten your application in production.
• Severity Grading: Every finding is classified as Critical, High, or Warning with clear remediation paths.
• AI-Powered Remediation: Automatically triggers the Vibe AI worker for detailed, developer-ready fix guides.