🛡️ VibeGuard AI

AI-Powered Security Scanner for Vibe-Coded Applications

Your AI coding agent writes the code. VibeGuard checks the security.

VibeGuard AI is an open-source security scanner designed for modern applications built with AI coding tools, no-code/low-code platforms, and vibe-coding workflows.

It scans your project source code for potential security issues and provides clear findings, confidence levels, and recommendations.

---

✨ Features

• 🔍 Security vulnerability scanning
• 🚨 Severity-based findings
• 🎯 Confidence score for findings
• 🛡️ Potential XSS detection
• 🔐 Authentication & authorization checks
• 🔑 Secret and credential detection
• 🌐 API security checks
• 📦 Dependency security analysis
• ⚙️ Security configuration checks
• 🤖 AI-assisted security analysis
• 📄 Multiple report formats (JSON, Markdown, HTML, SARIF)
• 🔄 Git diff scanning (--diff)
• 💻 CLI-based workflow
• 🔌 VS Code / Cursor integration
• 🧑‍💻 Designed for vibe-coded applications

---

🚀 Installation

Requirements

Before installing VibeGuard, make sure you have:

• Git
• Node.js
• npm

Check your installation:

git --version
node --version
npm --version

---

📥 1. Clone the Repository

Clone VibeGuard from GitHub:

git clone https://github.com/speakcoreofficial-stack/VibeGuard-AI-Pluging.git

Enter the project:

cd VibeGuard-AI-Pluging

Check the project files:

dir

On macOS/Linux:

ls

---

📦 2. Install Dependencies

Inside the VibeGuard-AI-Pluging directory, run:

npm install

Wait until the installation completes successfully.

---

🔨 3. Build VibeGuard

Build the CLI:

npm run build

After the build completes, verify that the CLI exists.

Windows PowerShell:

Test-Path .\packages\cli\dist\index.js

The expected result is:

True

If the result is True, the VibeGuard CLI has been successfully built.

---

▶️ 4. Test the CLI

You can test VibeGuard directly without installing the global command.

From the VibeGuard repository:

node ./packages/cli/dist/index.js version

If a version number is displayed, the CLI is working correctly.

Example:

VibeGuard 0.1.0

---

🔎 5. Scan Your Project

VibeGuard is designed to scan your own project or a project you are authorized to test.

For example, suppose your project is located at:

D:\aditya\my-project

Move into your project:

cd D:\aditya\my-project

Then run VibeGuard:

node D:\aditya\VibeGuard-AI-Pluging\packages\cli\dist\index.js scan

VibeGuard will analyze the project and report potential security findings.

---

📊 Example Finding

VibeGuard may report findings like:

[HIGH] Potential XSS: Unsafe HTML rendering

File: src/components/Example.tsx
Confidence: 70%

Recommendation:
Use safe rendering methods or sanitize untrusted HTML
before rendering.

Each finding can include:

• Severity
• Vulnerability type
• File location
• Confidence score
• Recommendation
• Evidence

---

🧪 Scan Options

Scan the entire project

vibeguard scan

Scan a specific file

vibeguard scan --file src/auth.ts

Scan only changed files (git diff)

vibeguard scan --diff

AI-assisted scan

vibeguard scan --ai

CI mode

vibeguard scan --ci

Report format output

vibeguard scan --format json
vibeguard scan --format markdown
vibeguard scan --format html
vibeguard scan --format sarif
vibeguard scan --format json -o report.json

Initialize project config

vibeguard init

Note: The vibeguard command requires the CLI to be installed globally. If it is not available on your system, use the direct Node.js command shown in the installation section.

---

🛠️ Global CLI Installation

If you want to use:

vibeguard scan

instead of:

node ./packages/cli/dist/index.js scan

install VibeGuard globally from the cloned repository (run from the packages/cli directory):

cd packages/cli
npm install -g .

Then verify:

vibeguard version

Expected output:

VibeGuard 0.1.0

If the command is recognized, you can scan your project with:

cd path/to/your-project
vibeguard scan

Replace path/to/your-project with the actual path of your project.

---

💻 VS Code & Cursor

VibeGuard is designed to work with VS Code and Cursor.

Build the extension:

cd packages/vscode
npm install

Install the VS Code extension packaging tool:

npm install -g @vscode/vsce

Create the VSIX package:

vsce package

This will generate a .vsix file.

Install the VSIX

In VS Code or Cursor:

Extensions
    ↓
...
    ↓
Install from VSIX
    ↓
Select the generated .vsix file

After installation, VibeGuard can be used directly from the editor.

---

🔌 Agent Plugins (opencode + Claude Code)

VibeGuard includes plugins so your AI coding agent scans automatically.

opencode

npm run build -w @vibeguard/integrations
cp packages/integrations/dist/opencode/opencode.js .opencode/plugin/opencode.js

Or reference it from opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["/absolute/path/VibeGuard-AI-Pluging/packages/integrations/dist/opencode/opencode.js"]
}

What you get:

• A vibeguard_scan tool the agent can call
• A /vibeguard-scan command for a readable summary + fix discussion
• An auto security hint after every edit/write that introduces findings

Restart opencode after adding the plugin.

Claude Code

mkdir -p .claude-plugin
cp -r packages/integrations/claude/. .claude-plugin/

What you get:

• /vibeguard command — runs npx vibeguard scan and explains findings
• vibeguard-scan skill — automatically triggers when generating code or when asked "is this code secure?"
• post_tool_use.sh hook — post-edit security hint for source files

---

🧪 Example Vulnerable Application

VibeGuard includes example applications for testing the scanner.

Navigate to the example:

cd examples/vulnerable-app

Then run:

node ../../packages/cli/dist/index.js scan

This allows developers to test VibeGuard locally without scanning an external application.

Expected result (intentionally vulnerable example):

Critical: 1   High: 4
Security Score: 40/100
[CRITICAL] Possible exposed API credential
[HIGH] Vulnerable dependency detected: express
[HIGH] Vulnerable dependency detected: axios
[HIGH] Potential XSS: Unsafe HTML rendering
[HIGH] Potential Missing Authorization

---

🏗️ Project Structure

VibeGuard-AI-Pluging/
│
├── packages/
│   ├── core/                 # @vibeguard/core — scanners, findings, reporter
│   ├── cli/                  # vibeguard — the CLI
│   ├── vscode/               # VS Code / Cursor extension
│   ├── ai/                   # @vibeguard/ai — AI reviewer
│   └── integrations/         # opencode + Claude Code plugins
│
├── examples/
│   └── vulnerable-app/
│
├── README.md
├── LICENSE
└── package.json

---

🔐 Security Philosophy

VibeGuard is designed as a defensive security tool.

It focuses on helping developers identify and fix security problems in applications they own or are authorized to test.

VibeGuard should not be used to access, attack, or test systems without permission.

VibeGuard is local-first: your source code is scanned on your machine by default and never uploaded unless you explicitly enable an AI provider.

---

🎯 Why VibeGuard?

Modern AI coding tools can generate applications extremely quickly.

However, AI-generated code can also introduce:

• insecure authentication
• missing authorization
• exposed secrets
• unsafe input handling
• insecure APIs
• vulnerable dependencies
• unsafe configuration
• XSS risks

VibeGuard acts as a security layer between AI-generated code and production.

AI Coding Agent
       ↓
   Generated Code
       ↓
   🛡️ VibeGuard
       ↓
Security Analysis
       ↓
Findings + Recommendations
       ↓
   Safer Application

---

🗺️ Roadmap

V1

• CLI foundation
• Source-code scanning
• Security findings
• Severity levels
• Confidence scores
• Basic XSS detection
• Secret detection
• Dependency scanning
• Single-file scanning (--file)
• Git diff scanning (--diff)
• AI explanations (--ai)
• CI mode (--ci)
• JSON / Markdown / HTML / SARIF reports
• VS Code + Cursor extension
• opencode + Claude Code plugins
• Improved false-positive filtering
• Finding deduplication
• Authentication analysis

V2

• GitHub Actions
• Pull Request security comments
• Python support
• Go support
• Java support
• PHP support
• Advanced data-flow analysis

V3

• AI security agent
• Architecture analysis
• Runtime verification
• Automated security verification
• Continuous security monitoring

---

🤝 Contributing

Contributions are welcome!

1. Fork the repository

git clone https://github.com/speakcoreofficial-stack/VibeGuard-AI-Pluging.git

2. Create a branch

git checkout -b feature/my-feature

3. Make your changes

4. Test your changes

npm install
npm run build

5. Commit

git add .
git commit -m "Add my feature"

6. Push

git push origin feature/my-feature

Then open a Pull Request.

---

📄 License

This project is licensed under the MIT License.

See:

LICENSE

---

⚠️ Disclaimer

VibeGuard is a defensive security analysis tool.

Only scan applications and source code that you own or have explicit permission to test.

The developers and contributors are not responsible for misuse of this software.

VibeGuard's AI-provided explanations, confidence scores, and severity ratings reflect detected signals and do not guarantee that an application is secure.

---

⭐ Support the Project

If VibeGuard is useful to you:

• ⭐ Star the repository
• 🐛 Report bugs
• 💡 Suggest features
• 🤝 Contribute code
• 📢 Share the project

---

VibeGuard AI

Scan Before You Ship. 🛡️

Your AI coding agent writes the code.

VibeGuard checks the security.