Bun Bun
78 lines
1.9 KiB
Markdown
78 lines
1.9 KiB
Markdown
# Vibe-Coded SaaS Security Scanner
|
|
|
|
Automated security scanner for vibe-coded / AI-generated SaaS apps. Detects exposed API keys, missing input validation, and insecure client-side secrets.
|
|
|
|
## Install
|
|
|
|
```bash
|
|
npm install -g vibe-coded-saas-security-scanner
|
|
```
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
# Scan current directory
|
|
vibe-scan .
|
|
|
|
# Scan specific paths with JSON output
|
|
vibe-scan --format json --output report.json ./src ./lib
|
|
|
|
# Only show critical and high severity findings
|
|
vibe-scan --min-severity high ./src
|
|
|
|
# Only scan for secrets
|
|
vibe-scan --categories secret ./src
|
|
```
|
|
|
|
## Output Formats
|
|
|
|
- `text` (default) — human-readable colored terminal output
|
|
- `json` — structured JSON for CI integration
|
|
- `sarif` — SARIF v2.1.0 for GitHub/CodeQL integration
|
|
- `markdown` — Markdown report for PR comments
|
|
|
|
## Exit Codes
|
|
|
|
- `0` — No critical findings
|
|
- `1` — Scanner error
|
|
- `2` — At least one critical finding detected
|
|
|
|
## Categories
|
|
|
|
- **secret** — Exposed API keys, tokens, passwords, private keys
|
|
- **injection** — SQL injection, NoSQL injection, command injection, path traversal
|
|
- **client-side** — DOM XSS, dangerous eval, dangerouslySetInnerHTML
|
|
- **validation** — Missing input validation, mass assignment, insecure uploads
|
|
- **config** — Missing CORS, insecure cookies, debug mode, HTTP instead of HTTPS
|
|
|
|
## Rules
|
|
|
|
The scanner includes 25+ detection rules covering:
|
|
|
|
- Stripe, AWS, OpenAI, Twilio, SendGrid, GitHub, Slack tokens
|
|
- Database connection strings
|
|
- JWT secrets and session keys
|
|
- Private keys
|
|
- SQL / NoSQL / Command injection patterns
|
|
- Path traversal
|
|
- XSS and dangerous DOM operations
|
|
- Missing CORS, cookie, rate limiting configurations
|
|
- Insecure file uploads
|
|
- Debug mode in production
|
|
|
|
## CI Integration
|
|
|
|
```yaml
|
|
- name: Security Scan
|
|
run: |
|
|
npx vibe-coded-saas-security-scanner --format sarif --output security.sarif .
|
|
- name: Upload SARIF
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: security.sarif
|
|
```
|
|
|
|
## License
|
|
|
|
MIT
|