Vibe-Guard: Developer-First Security Scanner

Summary

I built Vibe-Guard, a CLI‑first security scanner designed to fit naturally into developer workflows. It scans repositories for exposed secrets, insecure configurations, and common vulnerabilities locally and in CI/CD, producing actionable reports with minimal setup.

The focus is on low noise, zero dependencies, and fast startup, with cross‑platform binaries and SARIF output for GitHub Code Scanning.

Impact / Why It Matters

Security that devs actually run – Simple CLI, minimal config, and fast scans make it easy to adopt in daily work and CI.
Fewer false positives – 28 focused rules targeting real issues that occur in practice, not theoretical edge cases.
Easy CI integration – SARIF output and GitHub Actions examples enable automated security gates without heavy tooling.
Educational angle – Interactive commands (start, learn, demo) help teams understand vulnerabilities while scanning.

What I Built

Scanning Architecture – Rule engine, reporter, caching, and config layers with single‑responsibility modules (scanner, rules, reporter, config).
28 Security Rules – Coverage across OWASP‑style issues, secrets, configuration risks, and modern threats (AI safety, container security).
CLI & Reporters – Clean, intuitive CLI with configurable rules, deterministic CI output, and developer‑friendly local reports.
CI/CD Integration – SARIF export for GitHub Code Scanning, example workflows, and pre‑commit hook support.
Cross‑Platform Binaries – Zero‑dependency Node.js package with macOS/Windows builds; documentation for Homebrew and direct downloads.
Interactive Learning – vibe-guard start, learn [topic], and demo commands for hands‑on security education.

Results & Evidence

Adoption & usage:

3.1k+ total downloads on npm with growing adoption.
Used in CI pipelines for automated security checks on commits and PRs.

Performance & reliability:

Fast startup (~41ms) and small file scans (~51ms) in typical usage.
Zero external runtime dependencies, reducing breakage and install friction.

Coverage:

28 rules across:
- Authentication & authorization gaps
- Input validation (SQLi, XSS, directory traversal)
- Data protection (exposed secrets, insecure logging)
- Configuration (CORS, security headers, insecure configs)
- Modern threats (CSRF, AI‑generated code validation, prompt injection)
- Dependencies and container security (Kubernetes, Dockerfile, registry issues)

CI integration:

SARIF output for GitHub Code Scanning:

1
2
- name: Security Scan
  run: vibe-guard scan . --format sarif --output-file security-report.sarif

Jest → SARIF converter for test‑based security reporting.

Tech & Methods

Language: TypeScript, Node.js
Architecture: Rule engine + reporter + cache; deterministic output for CI
Security Coverage: OWASP‑aligned rules + secrets + AI safety + container security
CI/CD: GitHub Actions, SARIF format, pre‑commit hooks
Distribution: npm package, Homebrew tap, direct binary downloads (macOS/Windows)

Limits & Next Steps

Validated:

End‑to‑end scanning from CLI to CI reports.
28 rules covering common, high‑impact issues.
Cross‑platform usage on macOS and Windows; npm and Homebrew installs.

Not (yet) validated:

Full Linux/Arch binary support (currently known issue; see README).
Large‑scale enterprise deployments with custom rule packs.
Deep integration with other SAST/dependency scanners in a unified dashboard.

Next steps:

Restore and debug Linux/Arch binaries.
Expand rule set based on real‑world findings and community feedback.
Add richer integrations (e.g., GitLab, Azure DevOps) and policy controls.

Usage

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
# Install globally
npm install -g vibe-guard

# Start interactive session
vibe-guard start

# Scan your project
vibe-guard scan .

# Learn about security concepts
vibe-guard learn xss-detection

# Try with demo files
vibe-guard demo

CI example (GitHub Actions):

1
2
- name: Security Scan
  run: vibe-guard scan . --format sarif --output-file security-report.sarif