🛡️ VibeGuard AI
AI-Powered Security Scanner for Vibe-Coded Applications
Your AI coding agent writes the code. VibeGuard checks the security.
VibeGuard AI is an open-source security scanner designed for modern applications built with AI coding tools, no-code/low-code platforms, and vibe-coding workflows.
It scans your project source code for potential security issues and provides clear findings, confidence levels, and recommendations.
✨ Features
- 🔍 Security vulnerability scanning
- 🚨 Severity-based findings
- 🎯 Confidence score for findings
- 🛡️ Potential XSS detection
- 🔐 Authentication & authorization checks
- 🔑 Secret and credential detection
- 🌐 API security checks
- 📦 Dependency security analysis
- ⚙️ Security configuration checks
- 🤖 AI-assisted security analysis
- 📄 Multiple report formats (JSON, Markdown, HTML, SARIF)
- 🔄 Git diff scanning (
--diff)
- 💻 CLI-based workflow
- 🔌 VS Code / Cursor integration
- 🧑💻 Designed for vibe-coded applications
🚀 Installation
Requirements
Before installing VibeGuard, make sure you have:
Check your installation:
git --version
node --version
npm --version
📥 1. Clone the Repository
Clone VibeGuard from GitHub:
git clone https://github.com/speakcoreofficial-stack/VibeGuard-AI-Pluging.git
Enter the project:
cd VibeGuard-AI-Pluging
Check the project files:
dir
On macOS/Linux:
ls
📦 2. Install Dependencies
Inside the VibeGuard-AI-Pluging directory, run:
npm install
Wait until the installation completes successfully.
🔨 3. Build VibeGuard
Build the CLI:
npm run build
After the build completes, verify that the CLI exists.
Windows PowerShell:
Test-Path .\packages\cli\dist\index.js
The expected result is:
True
If the result is True, the VibeGuard CLI has been successfully built.
▶️ 4. Test the CLI
You can test VibeGuard directly without installing the global command.
From the VibeGuard repository:
node ./packages/cli/dist/index.js version
If a version number is displayed, the CLI is working correctly.
Example:
VibeGuard 0.1.0
🔎 5. Scan Your Project
VibeGuard is designed to scan your own project or a project you are authorized to test.
For example, suppose your project is located at:
D:\aditya\my-project
Move into your project:
cd D:\aditya\my-project
Then run VibeGuard:
node D:\aditya\VibeGuard-AI-Pluging\packages\cli\dist\index.js scan
VibeGuard will analyze the project and report potential security findings.
📊 Example Finding
VibeGuard may report findings like:
[HIGH] Potential XSS: Unsafe HTML rendering
File: src/components/Example.tsx
Confidence: 70%
Recommendation:
Use safe rendering methods or sanitize untrusted HTML
before rendering.
Each finding can include:
- Severity
- Vulnerability type
- File location
- Confidence score
- Recommendation
- Evidence
🧪 Scan Options
Scan the entire project
vibeguard scan
Scan a specific file
vibeguard scan --file src/auth.ts
Scan only changed files (git diff)
vibeguard scan --diff
AI-assisted scan
vibeguard scan --ai
CI mode
vibeguard scan --ci
Report format output
vibeguard scan --format json
vibeguard scan --format markdown
vibeguard scan --format html
vibeguard scan --format sarif
vibeguard scan --format json -o report.json
Initialize project config
vibeguard init
Note: The vibeguard command requires the CLI to be installed globally. If it is not available on your system, use the direct Node.js command shown in the installation section.
🛠️ Global CLI Installation
If you want to use:
vibeguard scan
instead of:
node ./packages/cli/dist/index.js scan
install VibeGuard globally from the cloned repository (run from the packages/cli directory):
cd packages/cli
npm install -g .
Then verify:
vibeguard version
Expected output:
VibeGuard 0.1.0
If the command is recognized, you can scan your project with:
cd path/to/your-project
vibeguard scan
Replace path/to/your-project with the actual path of your project.
💻 VS Code & Cursor
VibeGuard is designed to work with VS Code and Cursor.
Build the extension:
cd packages/vscode
npm install
Install the VS Code extension packaging tool:
npm install -g @vscode/vsce
Create the VSIX package:
vsce package
This will generate a .vsix file.
Install the VSIX
In VS Code or Cursor:
Extensions
↓
...
↓
Install from VSIX
↓
Select the generated .vsix file
After installation, VibeGuard can be used directly from the editor.
🔌 Agent Plugins (opencode + Claude Code)
VibeGuard includes plugins so your AI coding agent scans automatically.
opencode
npm run build -w @vibeguard/integrations
cp packages/integrations/dist/opencode/opencode.js .opencode/plugin/opencode.js
Or reference it from opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"plugin": ["/absolute/path/VibeGuard-AI-Pluging/packages/integrations/dist/opencode/opencode.js"]
}
What you get:
- A
vibeguard_scan tool the agent can call
- A
/vibeguard-scan command for a readable summary + fix discussion
- An auto security hint after every
edit/write that introduces findings
Restart opencode after adding the plugin.
Claude Code
mkdir -p .claude-plugin
cp -r packages/integrations/claude/. .claude-plugin/
What you get:
/vibeguard command — runs npx vibeguard scan and explains findingsvibeguard-scan skill — automatically triggers when generating code or when asked "is this code secure?"post_tool_use.sh hook — post-edit security hint for source files
🧪 Example Vulnerable Application
VibeGuard includes example applications for testing the scanner.
Navigate to the example:
cd examples/vulnerable-app
Then run:
node ../../packages/cli/dist/index.js scan
This allows developers to test VibeGuard locally without scanning an external application.
Expected result (intentionally vulnerable example):
Critical: 1 High: 4
Security Score: 40/100
[CRITICAL] Possible exposed API credential
[HIGH] Vulnerable dependency detected: express
[HIGH] Vulnerable dependency detected: axios
[HIGH] Potential XSS: Unsafe HTML rendering
[HIGH] Potential Missing Authorization
🏗️ Project Structure
VibeGuard-AI-Pluging/
│
├── packages/
│ ├── core/ # @vibeguard/core — scanners, findings, reporter
│ ├── cli/ # vibeguard — the CLI
│ ├── vscode/ # VS Code / Cursor extension
│ ├── ai/ # @vibeguard/ai — AI reviewer
│ └── integrations/ # opencode + Claude Code plugins
│
├── examples/
│ └── vulnerable-app/
│
├── README.md
├── LICENSE
└── package.json
🔐 Security Philosophy
VibeGuard is designed as a defensive security tool.
It focuses on helping developers identify and fix security problems in applications they own or are authorized to test.
VibeGuard should not be used to access, attack, or test systems without permission.
VibeGuard is local-first: your source code is scanned on your machine by default and never uploaded unless you explicitly enable an AI provider.
🎯 Why VibeGuard?
Modern AI coding tools can generate applications extremely quickly.
However, AI-generated code can also introduce:
- insecure authentication
- missing authorization
- exposed secrets
- unsafe input handling
- insecure APIs
- vulnerable dependencies
- unsafe configuration
- XSS risks
VibeGuard acts as a security layer between AI-generated code and production.
AI Coding Agent
↓
Generated Code
↓
🛡️ VibeGuard
↓
Security Analysis
↓
Findings + Recommendations
↓
Safer Application
🗺️ Roadmap
V1
V2
V3
🤝 Contributing
Contributions are welcome!
1. Fork the repository
git clone https://github.com/speakcoreofficial-stack/VibeGuard-AI-Pluging.git
2. Create a branch
git checkout -b feature/my-feature
3. Make your changes
4. Test your changes
npm install
npm run build
5. Commit
git add .
git commit -m "Add my feature"
6. Push
git push origin feature/my-feature
Then open a Pull Request.
📄 License
This project is licensed under the MIT License.
See:
LICENSE
⚠️ Disclaimer
VibeGuard is a defensive security analysis tool.
Only scan applications and source code that you own or have explicit permission to test.
The developers and contributors are not responsible for misuse of this software.
VibeGuard's AI-provided explanations, confidence scores, and severity ratings reflect detected signals and do not guarantee that an application is secure.
⭐ Support the Project
If VibeGuard is useful to you:
- ⭐ Star the repository
- 🐛 Report bugs
- 💡 Suggest features
- 🤝 Contribute code
- 📢 Share the project
VibeGuard AI
Scan Before You Ship. 🛡️
Your AI coding agent writes the code.
VibeGuard checks the security.
