feat: Vibe-Coded SaaS Security Scanner v1.0.0 - automated security scanner for vibe-coded AI-generated SaaS apps

2026-06-18 18:27:39 +00:00
commit fb175822b7
13 changed files with 3415 additions and 0 deletions
@@ -0,0 +1,77 @@
+# Vibe-Coded SaaS Security Scanner
+
+Automated security scanner for vibe-coded / AI-generated SaaS apps. Detects exposed API keys, missing input validation, and insecure client-side secrets.
+
+## Install
+
+```bash
+npm install -g vibe-coded-saas-security-scanner
+```
+
+## Usage
+
+```bash
+# Scan current directory
+vibe-scan .
+
+# Scan specific paths with JSON output
+vibe-scan --format json --output report.json ./src ./lib
+
+# Only show critical and high severity findings
+vibe-scan --min-severity high ./src
+
+# Only scan for secrets
+vibe-scan --categories secret ./src
+```
+
+## Output Formats
+
+- `text` (default) — human-readable colored terminal output
+- `json` — structured JSON for CI integration
+- `sarif` — SARIF v2.1.0 for GitHub/CodeQL integration
+- `markdown` — Markdown report for PR comments
+
+## Exit Codes
+
+- `0` — No critical findings
+- `1` — Scanner error
+- `2` — At least one critical finding detected
+
+## Categories
+
+- **secret** — Exposed API keys, tokens, passwords, private keys
+- **injection** — SQL injection, NoSQL injection, command injection, path traversal
+- **client-side** — DOM XSS, dangerous eval, dangerouslySetInnerHTML
+- **validation** — Missing input validation, mass assignment, insecure uploads
+- **config** — Missing CORS, insecure cookies, debug mode, HTTP instead of HTTPS
+
+## Rules
+
+The scanner includes 25+ detection rules covering:
+
+- Stripe, AWS, OpenAI, Twilio, SendGrid, GitHub, Slack tokens
+- Database connection strings
+- JWT secrets and session keys
+- Private keys
+- SQL / NoSQL / Command injection patterns
+- Path traversal
+- XSS and dangerous DOM operations
+- Missing CORS, cookie, rate limiting configurations
+- Insecure file uploads
+- Debug mode in production
+
+## CI Integration
+
+```yaml
+- name: Security Scan
+  run: |
+    npx vibe-coded-saas-security-scanner --format sarif --output security.sarif .
+- name: Upload SARIF
+  uses: github/codeql-action/upload-sarif@v3
+  with:
+    sarif_file: security.sarif
+```
+
+## License
+
+MIT