⚡ vibe-check

Built by The Foundry, an autonomous build pipeline I run. A Haiku scout finds a developer pain point, a Sonnet agent writes the spec, and aider driving Sonnet builds it overnight.

This repo was produced end to end by that pipeline. I commissioned the system, approved each phase of it and reviewed what it shipped.

Security scanner for AI-generated (vibe coded) projects.

AI code generators ship fast but skip security. vibe-check catches the secrets they hardcode, the debug modes they leave on, and the CORS wildcards they think are fine.

$ npx vibe-check .

  ⚡ vibe-check — security scanner for vibe-coded projects
  Scanning: /Users/dev/my-ai-project

  CRITICAL  🔑 Stripe Secret Key [stripe-secret-key]
  Location: src/payment.ts:14
  Issue: Hardcoded Stripe secret key detected
  Match: sk_t...oded
  ──────────────────────────────────────────────────────────
    13 | // Initialize Stripe
  > 14 | const stripe = new Stripe(process.env.STRIPE_KEY); // was hardcoded!
    15 | 
  ──────────────────────────────────────────────────────────
  💡 Fix: Use STRIPE_SECRET_KEY environment variable. Rotate the key in the Stripe dashboard.

  WARNING  ⚠️  CORS Wildcard Origin [cors-wildcard]
  Location: src/server.ts:8
  Issue: CORS is configured to allow all origins (*)
  ──────────────────────────────────────────────────────────
     7 | // Enable CORS
  >  8 | app.use(cors({ origin: '*' }));
     9 |
  ──────────────────────────────────────────────────────────
  💡 Fix: Restrict CORS to specific trusted origins. Use an allowlist.

  📊 Summary
  Files scanned: 23
  Duration: 45ms

    🔴 1 critical
    🟡 1 warning
    Total: 2 findings

  ❌ Critical issues found — fix these before deploying!

Features

• 🔑 Secret Detection — 30+ regex patterns for AWS, Stripe, GitHub, OpenAI, Anthropic, Slack, Discord, Twilio, SendGrid, and more
• 🎲 Entropy Analysis — catches unknown secret formats by detecting high-entropy strings in variable assignments
• ⚠️ Insecure Defaults — finds debug mode, CORS wildcards, disabled SSL, eval(), innerHTML, missing auth, and other antipatterns
• ⚙️ Config Checks — verifies .env files are gitignored
• 📊 Actionable Reports — severity levels (critical/warning/info), file locations, code snippets, and fix suggestions
• 🚦 CI-Friendly — exit code 1 on critical findings, JSON output mode
• 🪝 Git Hooks — install as a pre-commit hook to catch secrets before they're pushed
• 🙈 Suppressions — .vibecheckignore for known false positives

Installation

# Run directly (no install needed)
npx vibe-check .

# Or install globally
npm install -g vibe-check

Requirements: Node.js 18+

Usage

Basic Scan

# Scan current directory
vibe-check

# Scan a specific path
vibe-check ./my-project

# Scan with only critical findings
vibe-check --min-severity critical

Output Formats

# Pretty terminal output (default)
vibe-check .

# JSON for CI/CD pipelines
vibe-check . --format json

Git Pre-Commit Hook

# Install the hook
vibe-check --init-hook

# Now vibe-check runs automatically before each commit
git commit -m "ship it"  # blocked if critical issues found

Options

Flag	Description	Default
[path]	Directory to scan	.
-f, --format	Output format: pretty or json	pretty
-s, --min-severity	Minimum severity: critical, warning, info	info
--no-entropy	Disable entropy-based detection	enabled
--ignore <path>	Path to .vibecheckignore file	auto-detected
--init-hook	Install git pre-commit hook	—
-v, --verbose	Verbose output	—

Suppressing False Positives

Create a .vibecheckignore file (same syntax as .gitignore):

# Test fixtures with intentional secrets
test/fixtures/
*.test.ts

# Generated files
generated/

What It Detects

Secrets (30+ patterns)

Category	Examples
Cloud	AWS access keys, GCP API keys, service accounts
Payments	Stripe secret/restricted keys
Code Platforms	GitHub PATs, OAuth tokens, fine-grained tokens
AI Services	OpenAI API keys, Anthropic keys
Communication	Slack tokens/webhooks, Discord bot tokens/webhooks, Twilio, SendGrid
Infrastructure	Heroku API keys, npm/PyPI tokens, database connection strings
Crypto	Private keys (RSA, EC, DSA, OpenSSH), JWT secrets
Generic	Hardcoded passwords, bearer tokens, basic auth credentials
Entropy	Unknown high-entropy strings in assignments

Insecure Defaults

Pattern	Severity
Flask debug=True	Critical
Django DEBUG = True	Critical
Disabled auth	Critical
SSL verification disabled	Critical
Insecure default secret key	Critical
Server env exposed to client	Critical
CORS wildcard origin	Warning
eval() usage	Warning
innerHTML assignment	Warning
Insecure cookie settings	Warning
Missing auth TODO comments	Warning
Debug mode enabled	Warning

Architecture

src/
├── index.ts              # CLI entry point (Commander.js)
├── scanner.ts            # Core scanning engine
├── reporter.ts           # Pretty + JSON output formatters
├── entropy.ts            # Shannon entropy detection
├── hooks.ts              # Git pre-commit hook installer
├── types.ts              # TypeScript interfaces
└── patterns/
    ├── secrets.ts        # 30+ secret detection patterns
    └── insecure-defaults.ts  # Insecure default patterns

Known Limitations

• Pattern-based detection (no AST analysis) — may produce false positives on comments or test data
• Entropy detection can flag legitimate high-entropy strings (UUIDs, hashes)
• Does not detect language-specific vulnerabilities (SQL injection, XSS logic)
• No auto-fix capability — reports issues for manual remediation

Future Improvements

• SARIF output format for GitHub Security tab integration
• Custom rule definitions via config file
• Language-aware scanning with AST parsers
• Baseline support (only report new findings)
• VS Code extension

License

MIT

---

Built by The Foundry 🏭