Vibe-Coded SaaS Security Scanner

Automated security scanner for vibe-coded / AI-generated SaaS apps. Detects exposed API keys, missing input validation, and insecure client-side secrets.

Install

npm install -g vibe-coded-saas-security-scanner

Usage

# Scan current directory
vibe-scan .

# Scan specific paths with JSON output
vibe-scan --format json --output report.json ./src ./lib

# Only show critical and high severity findings
vibe-scan --min-severity high ./src

# Only scan for secrets
vibe-scan --categories secret ./src

Output Formats

• text (default) — human-readable colored terminal output
• json — structured JSON for CI integration
• sarif — SARIF v2.1.0 for GitHub/CodeQL integration
• markdown — Markdown report for PR comments

Exit Codes

• 0 — No critical findings
• 1 — Scanner error
• 2 — At least one critical finding detected

Categories

• secret — Exposed API keys, tokens, passwords, private keys
• injection — SQL injection, NoSQL injection, command injection, path traversal
• client-side — DOM XSS, dangerous eval, dangerouslySetInnerHTML
• validation — Missing input validation, mass assignment, insecure uploads
• config — Missing CORS, insecure cookies, debug mode, HTTP instead of HTTPS

Rules

The scanner includes 25+ detection rules covering:

• Stripe, AWS, OpenAI, Twilio, SendGrid, GitHub, Slack tokens
• Database connection strings
• JWT secrets and session keys
• Private keys
• SQL / NoSQL / Command injection patterns
• Path traversal
• XSS and dangerous DOM operations
• Missing CORS, cookie, rate limiting configurations
• Insecure file uploads
• Debug mode in production

CI Integration

- name: Security Scan
  run: |
    npx vibe-coded-saas-security-scanner --format sarif --output security.sarif .
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: security.sarif

License

MIT