{"id":28902781,"url":"https://github.com/devjosef/vibe-guard","last_synced_at":"2026-01-20T17:31:53.993Z","repository":{"id":295968283,"uuid":"991762764","full_name":"Devjosef/vibe-guard","owner":"Devjosef","description":"Security guardrails for vibe coders - catch issues before they catch you","archived":false,"fork":false,"pushed_at":"2025-06-09T05:23:45.000Z","size":90520,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-06-09T06:26:21.962Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Devjosef.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY_RULES.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-05-28T05:46:40.000Z","updated_at":"2025-06-09T05:23:53.000Z","dependencies_parsed_at":"2025-05-28T10:28:17.056Z","dependency_job_id":null,"html_url":"https://github.com/Devjosef/vibe-guard","commit_stats":null,"previous_names":["devjosef/vibe-guard"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/Devjosef/vibe-guard","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Devjosef%2Fvibe-guard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Devjosef%2Fvibe-guard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Devjosef%2Fvibe-guard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Devjosef%2Fvibe-guard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Devjosef","download_url":"https://codeload.github.com/Devjosef/vibe-guard/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Devjosef%2Fvibe-guard/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261114919,"owners_count":23111847,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-21T11:31:21.656Z","updated_at":"2026-01-20T17:31:53.978Z","avatar_url":"https://github.com/Devjosef.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ██ Vibe-Guard Security Scanner\n\n**Professional Security Scanner** - Zero dependencies, instant setup, works everywhere. Optimized performance for security scanning. Current ruleset: 28 essential security rules including container security.\n\n[![npm version](https://img.shields.io/npm/v/vibe-guard.svg)](https://www.npmjs.com/package/vibe-guard)\n[![Downloads (total)](https://img.shields.io/npm/dt/vibe-guard.svg)](https://www.npmjs.com/package/vibe-guard)\n[![License](https://img.shields.io/npm/l/vibe-guard.svg)](https://github.com/Devjosef/vibe-guard/blob/main/LICENSE)\n[![Test Scanning](https://github.com/Devjosef/vibe-guard/actions/workflows/test-scanning.yml/badge.svg)](https://github.com/Devjosef/vibe-guard/actions/workflows/test-scanning.yml)\n\n## Quick Start\n\n```bash\n# Install globally\nnpm install -g vibe-guard\n\n# For Development with no build step(run this first)\nnpm run dev\n\n# Start interactive session\nvibe-guard start\n\n# Scan your project\nvibe-guard scan .\n\n# Learn about security concepts\nvibe-guard learn xss-detection\n\n# Try with demo files\nvibe-guard demo\n```\n\n## Interactive Security Learning\n\nVibe-Guard is more than a scanner—it's an educational platform that teaches you about web security through hands-on experience:\n\n### Understanding Vulnerabilities\n\n**XSS (Cross-Site Scripting):**\n```javascript\n// ❌ Vulnerable code\napp.get('/user', (req, res) =\u003e {\n  const userInput = req.query.name;\n  res.send('\u003ch1\u003eHello ' + userInput + '\u003c/h1\u003e'); // XSS vulnerability!\n});\n\n// ✅ Secure code\napp.get('/user', (req, res) =\u003e {\n  const userInput = req.query.name;\n  res.send('\u003ch1\u003eHello ' + escapeHtml(userInput) + '\u003c/h1\u003e');\n});\n```\n\n**SQL Injection:**\n```javascript\n// ❌ Vulnerable code\nconst query = 'SELECT * FROM users WHERE id = ' + userId; // SQL injection risk!\n\n// ✅ Secure code\nconst query = 'SELECT * FROM users WHERE id = ?';\ndb.query(query, [userId]);\n```\n\n**Exposed Secrets:**\n```javascript\n// ❌ Vulnerable code\nconst API_KEY = 'sk-1234567890abcdef'; // Secret exposed in source code!\n\n// ✅ Secure code\nconst API_KEY = process.env.API_KEY; // Environment variable\n```\n\n**Container Security:**\n```yaml\n# ❌ Vulnerable Kubernetes manifest\napiVersion: apps/v1\nkind: Deployment\nspec:\n  template:\n    spec:\n      containers:\n      - name: app\n        image: nginx:latest  # Latest tag vulnerability\n        securityContext:\n          runAsUser: 0       # Root user vulnerability\n          privileged: true   # Privileged container vulnerability\n\n# ✅ Secure Kubernetes manifest\napiVersion: apps/v1\nkind: Deployment\nspec:\n  template:\n    spec:\n      containers:\n      - name: app\n        image: nginx:1.21.6@sha256:abc123...  # Pinned digest\n        securityContext:\n          runAsUser: 1000    # Non-root user\n          runAsNonRoot: true\n          allowPrivilegeEscalation: false\n```\n\n### Security Best Practices\n\n1. **Input Validation** - Always validate and sanitize user input\n2. **Output Encoding** - Encode output to prevent XSS attacks\n3. **Parameterized Queries** - Use prepared statements for database operations\n4. **Environment Variables** - Never hardcode secrets in source code\n5. **Security Headers** - Implement proper HTTP security headers\n\n6. **Container Security** - Use non-root users, pinned image digests, and proper security contexts\n\n## Comprehensive Security Coverage\n\nVibe-Guard detects 28 types of vulnerabilities across multiple categories:\n\n- **Authentication \u0026 Authorization**: Missing authentication, broken access control, session management\n- **Input Validation**: SQL injection, XSS, unvalidated input, directory traversal\n- **Data Protection**: Exposed secrets, hardcoded sensitive data, insecure logging\n- **Configuration**: Insecure configuration, missing security headers, CORS issues\n- **Modern Threats**: CSRF protection, AI-generated code validation, prompt injection\n- **Dependencies**: Insecure dependencies, outdated packages, vulnerability assessment\n- **Container Security**: Kubernetes security, Dockerfile vulnerabilities, container registry issues\n\n## Professional Use Cases\n\n**CI/CD Integration:**\n```yaml\n# GitHub Actions\n- name: Security Scan\n  run: vibe-guard scan . --format sarif --output-file security-report.sarif\n```\n\n## SARIF test reporting\n\nThis repository can produce SARIF from the Jest test suite for integration with GitHub Code Scanning.\nLocally you can run:\n\n```bash\n# run tests and produce JSON\nnpx jest --json --outputFile=jest-output.json\n\n# convert to SARIF\nnode scripts/jest-to-sarif.js jest-output.json test-results.sarif\n```\n\nThe `jest-to-sarif` converter supports two optional flags: `--include-passed` (include passed/skipped assertions in SARIF) and `--relative-paths` (output relative file paths instead of file:// URIs). Example:\n\n```bash\nnode scripts/jest-to-sarif.js jest-output.json test-results.sarif --include-passed --relative-paths\n```\n\nCI converts Jest JSON to SARIF and uploads the SARIF file when the tests are run in the CI workflow.\n\n**Pre-commit Hook:**\n```bash\n# .git/hooks/pre-commit\n#!/bin/sh\nvibe-guard scan . || exit 1\n```\n\n**Interactive Learning:**\n```bash\n# Start interactive session\nvibe-guard start\n\n# Learn specific security concepts\nvibe-guard learn sql-injection\nvibe-guard learn xss-detection\n\n# Practice with demo files\nvibe-guard demo\n```\n\n## Installation Options\n\n**NPM (Recommended):**\n```bash\nnpm install -g vibe-guard\n```\n\n**Homebrew:**\n```bash\nbrew install devjosef/tap/vibe-guard\n```\n\n**Direct Download:**\n```bash\n# Linux\ncurl -L https://github.com/Devjosef/vibe-guard/releases/latest/download/vibe-guard-linux-x64 -o vibe-guard\nchmod +x vibe-guard\n\n# macOS\ncurl -L https://github.com/Devjosef/vibe-guard/releases/latest/download/vibe-guard-macos-x64 -o vibe-guard\nchmod +x vibe-guard\n\n# Windows\ncurl -L https://github.com/Devjosef/vibe-guard/releases/latest/download/vibe-guard-windows-x64.exe -o vibe-guard.exe\n```\n\n## Documentation \u0026 Resources\n\n- **[Getting Started](https://devjosef.github.io/vibe-guard/getting-started.html)** - Complete setup and configuration guide\n- **[Security Rules](https://devjosef.github.io/vibe-guard/rules.html)** - Detailed rule explanations and examples\n- **[Performance Guide](https://devjosef.github.io/vibe-guard/performance.html)** - Optimization and best practices\n- **[API Reference](https://devjosef.github.io/vibe-guard/docs.html)** - Programmatic usage and integration\n\n## Community \u0026 Support\n\n**Join our community of security professionals and developers:**\n\n- **Interactive Learning**: `vibe-guard start` - Begin your security journey\n- **Educational Commands**: `vibe-guard learn [topic]` - Master security concepts\n- **Hands-on Practice**: `vibe-guard demo` - Test with example vulnerabilities\n- **Performance Insights**: `vibe-guard stats` - Track your security impact\n- **Community Discussion**: [GitHub Discussions](https://github.com/Devjosef/vibe-guard/discussions)\n- **Issue Reporting**: [GitHub Issues](https://github.com/Devjosef/vibe-guard/issues)\n- **Repository**: [GitHub Repository](https://github.com/Devjosef/vibe-guard)\n\n## Why Choose Vibe-Guard?\n\n**Built for developers who code fast and need security that keeps up:**\n\n- **Zero Dependencies** - Lightweight, fast, and reliable\n- **28 Security Rules** - Comprehensive coverage of modern threats including container security\n- **Cross-Platform** - Works seamlessly across all operating systems\n- **Educational Focus** - Learn security while you scan\n- **OWASP Aligned** - Industry best practices and standards\n- **Developer-Friendly** - Simple, intuitive CLI interface\n- **Interactive Mode** - Guided learning with `vibe-guard start`\n- **Container Security** - Kubernetes, Dockerfile, and registry security scanning\n\n## Impact \u0026 Adoption\n\nEvery scan contributes to a more secure web ecosystem:\n\n- **500+ total downloads** on NPM with growing adoption\n- **28 security rules** covering contemporary threat vectors including container security\n- **Cross-platform support** for Linux, macOS, and Windows\n- **Zero dependencies** ensuring maximum compatibility\n- **Educational approach** - building security awareness\n- **Container security** - Kubernetes, Dockerfile, and registry vulnerability detection\n\n## License\n\nMIT License - see [LICENSE](LICENSE) for details.\n\n---\n\n**Built for the greater good, like curl for security scanning.** \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdevjosef%2Fvibe-guard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdevjosef%2Fvibe-guard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdevjosef%2Fvibe-guard/lists"}