# Vibe-Coded SaaS Security Scanner

Automated security scanner for vibe-coded / AI-generated SaaS apps. Detects exposed API keys, missing input validation, and insecure client-side secrets.

## Install

```bash
npm install -g vibe-coded-saas-security-scanner
```

## Usage

```bash
# Scan current directory
vibe-scan .

# Scan specific paths with JSON output
vibe-scan --format json --output report.json ./src ./lib

# Only show critical and high severity findings
vibe-scan --min-severity high ./src

# Only scan for secrets
vibe-scan --categories secret ./src
```

## Output Formats

- `text` (default) — human-readable colored terminal output
- `json` — structured JSON for CI integration
- `sarif` — SARIF v2.1.0 for GitHub/CodeQL integration
- `markdown` — Markdown report for PR comments

## Exit Codes

- `0` — No critical findings
- `1` — Scanner error
- `2` — At least one critical finding detected

## Categories

- **secret** — Exposed API keys, tokens, passwords, private keys
- **injection** — SQL injection, NoSQL injection, command injection, path traversal
- **client-side** — DOM XSS, dangerous eval, dangerouslySetInnerHTML
- **validation** — Missing input validation, mass assignment, insecure uploads
- **config** — Missing CORS, insecure cookies, debug mode, HTTP instead of HTTPS

## Rules

The scanner includes 25+ detection rules covering:

- Stripe, AWS, OpenAI, Twilio, SendGrid, GitHub, Slack tokens
- Database connection strings
- JWT secrets and session keys
- Private keys
- SQL / NoSQL / Command injection patterns
- Path traversal
- XSS and dangerous DOM operations
- Missing CORS, cookie, rate limiting configurations
- Insecure file uploads
- Debug mode in production

## CI Integration

```yaml
- name: Security Scan
  run: |
    npx vibe-coded-saas-security-scanner --format sarif --output security.sarif .
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: security.sarif
```

## License

MIT