VibeSafe - Security Scanner for Vibe-Coded Applications

VibeSafe is a security scanner designed for AI-generated and vibe-coded applications. It helps identify common security issues in projects built with tools like Claude, ChatGPT, and other AI assistants.

Installation

Global Installation

npm install -g vibesafe-scanner
vibesafe scan

One-Time Usage with npx

npx vibesafe-scanner scan

Local Project Installation

npm install --save-dev vibesafe
npx vibesafe-scanner scan

Usage

Scan the current directory:

vibesafe scan

Scan a specific directory:

vibesafe scan --path ./my-project

Output as JSON:

vibesafe scan --json

What It Checks

VibeSafe scans for common security issues in vibe-coded projects:

• Secrets & Credentials: Hardcoded API keys, passwords, tokens
• Authentication Issues: Missing auth, insecure patterns
• Infrastructure Misconfigurations: Exposed admin panels, debugging enabled
• AI Spend Risks: Unbounded API calls, missing rate limits

Requirements

• No Python required! The npm package includes a standalone binary.
• Node.js 14+ (for the npm wrapper only)

Platform Support

• ✅ Windows (x64, arm64)
• ✅ macOS (x64, arm64)
• ✅ Linux (x64, arm64)

CI/CD Integration

GitHub Actions

name: Security Scan
on: [push, pull_request]

jobs:
  vibesafe:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '18'
      - run: npx vibesafe-scanner scan

GitLab CI

vibesafe:
  stage: test
  image: node:18
  script:
    - npx vibesafe-scanner scan

Exit Codes

• 0: No security issues found
• 1: Security issues detected or scan error

Links

• GitHub Repository
• Report Issues
• Website

License

MIT License - see LICENSE file for details.