vibesafe-scanner 0.1.0

Security scanner for vibe-coded applications

VibeSafe Scanner

A lightweight security scanner for vibe-coded applications.

Installation

pip install vibesafe

Or install from source:

pip install -e .

Usage

Scan the current directory:

vibesafe scan

Scan a specific directory:

vibesafe scan --path /path/to/project

Output as JSON:

vibesafe scan --json

What It Checks

Secrets

• .env files committed to git
• Hardcoded API keys (OpenAI, AWS, Google, GitHub, Slack)

AI Spend Risks

• AI calls inside loops
• Missing max_tokens limits
• Retry loops around AI calls

Authentication

• Debug authentication bypasses
• Plaintext password storage

Infrastructure

• Debug mode enabled
• CORS wildcard configuration
• Potential SQL injection risks

Exit Codes

• 0 - Scan passed, no failures
• 1 - Scan found failures or error occurred

Features

• 🚀 Fast (<5 seconds for most repos)
• 🎯 High-signal, low-noise checks
• 📍 Evidence-based findings with file:line references
• 🎨 Clear visual output with status icons
• 💡 Explains why each issue is dangerous
• 📊 Security score (0-100)

License

MIT