@jackdog668/vibeaudit

Vibe Audit

Security scanner for AI-generated codebases.

Vibe coding is fast. Shipping insecure code is faster. Vibe Audit catches the security time bombs that AI tools leave behind — exposed API keys, open database rules, missing auth, XSS vectors, prompt injection, unverified payment webhooks, and more — before they blow up in production.

npx @jackdog668/vibeaudit

No config required. 98 rules across 17 attack surfaces (now including accessibility/WCAG, scale/performance, and observability). Two production dependencies. Runs in seconds.

Every finding ships with a CWE ID, a CVSS v3.1 score, an OWASP Top 10 mapping, a plain-English explanation, and a copy-paste fix prompt for your AI coding tool.

---

Why This Exists

AI coding tools generate working code. But "working" and "secure" aren't the same thing. Every day, developers ship vibe-coded apps with:

• API keys hardcoded in source files
• service_role keys and Firebase Admin SDK shipped to the browser
• Supabase tables with Row Level Security turned off
• Firestore rules set to allow read, write: if true
• API routes and Server Actions with zero authentication
• User input piped straight into innerHTML, SQL, NoSQL, or an LLM prompt
• Stripe webhooks accepted without signature verification
• Paid AI calls with no spend limit (hello, surprise $10K bill)

Vibe Audit finds these in seconds and tells you exactly how to fix them — with explanations AND copy-paste prompts that work in any AI coding tool (Claude Code, Cursor, Lovable, Replit, Firebase Studio, and more).

---

Quick Start

# Audit the current directory
npx @jackdog668/vibeaudit

# Audit a specific local project
npx @jackdog668/vibeaudit ./my-app

# Audit a GitHub repo directly — no clone needed (scanned via the GitHub API)
npx @jackdog668/vibeaudit owner/repo
npx @jackdog668/vibeaudit https://github.com/owner/repo

# Deep scan — also check git history for committed secrets
npx @jackdog668/vibeaudit --deep

# Interactive HTML report (security grade A–F, CVSS charts, OWASP grid)
npx @jackdog668/vibeaudit --format html > audit-report.html

# Copy-paste fix prompts for your AI coding tool
npx @jackdog668/vibeaudit --fix

# JSON output for CI
npx @jackdog668/vibeaudit --format json --strict

Install globally if you run it a lot:

npm install -g @jackdog668/vibeaudit
vibeaudit            # then just call it directly

Requires Node >=18.3.0.

---

Output Formats

Format	Flag	Best for
Terminal	(default)	Quick local checks — security grade, per-file counts, CVSS scores, colored severity bar
HTML	--format html	Sharing/reporting — self-contained interactive report: A–F grade, CVSS distribution, OWASP Top 10 coverage grid, searchable findings, one-click fix-prompt copy, dark mode, PDF-exportable
Markdown	--format markdown	Dropping into a doc/PR with copy-paste fix prompts
JSON	--format json	CI pipelines and automation

Every security finding carries its CWE ID, CVSS v3.1 score, and OWASP Top 10 (2021) category. Accessibility findings carry a WCAG success criterion instead; scale/performance findings are quality checks with no security taxonomy.

---

What It Checks

98 rules across 17 categories, plus dependency scanning (SCA). Severity is as reported by Vibe Audit: CRIT · WARN · INFO. CVSS is the v3.1 base score.

Secrets & Credentials

Rule	Sev	CVSS	CWE	What it catches
exposed-secrets		7.5	CWE-798	API keys, tokens, private keys in source code
hardcoded-credentials		7.5	CWE-798	Passwords, connection strings, bearer tokens
exposed-env-vars		7.5	CWE-200	Secrets leaked via VITE_ / NEXT_PUBLIC_ / REACT_APP_ prefixes
client-bundle-secrets		7.5	CWE-200	Secrets in client code, visible in DevTools → Sources
insecure-jwt		7.5	CWE-347	Weak JWT secrets, missing algorithm pinning, no expiry
git-history-secrets		7.5	CWE-798	Secrets committed in past git history (--deep)
sensitive-browser-storage		6.5	CWE-922	Tokens / PII in localStorage / sessionStorage
missing-gitignore		5.3	CWE-538	.env not in .gitignore — one push leaks everything
secrets-in-urls		5.3	CWE-598	API keys in URL query params — logged everywhere
high-entropy-strings		5.0	CWE-798	Entropy-based detection of secret-looking strings

Auth & Authorization

Rule	Sev	CVSS	CWE	What it catches
missing-auth		9.8	CWE-306	API routes / endpoints with no authentication checks
idor-vulnerability		8.6	CWE-639	Routes using IDs without ownership verification
plaintext-passwords		7.5	CWE-256	Passwords stored/compared without hashing (or MD5/SHA1)
client-only-auth		6.5	CWE-602	Auth only on the frontend — bypassable via DevTools
no-account-lockout		5.3	CWE-307	Login endpoints with no brute-force protection

Injection & Input

Rule	Sev	CVSS	CWE	What it catches
no-input-validation		8.6	CWE-20	User input used unsafely without validation/sanitization
path-traversal		8.6	CWE-22	File ops with user input — read any file via ../
mass-assignment		8.1	CWE-915	Raw request body to DB — inject role / isAdmin
unsafe-file-upload		8.1	CWE-434	Uploads with no type validation or size limits
prototype-pollution		8.1	CWE-1321	Deep merge with user input — inject __proto__

Server-Side Exploits

Rule	Sev	CVSS	CWE	What it catches
ssrf-vulnerability		8.6	CWE-918	Server fetches user-provided URLs — reach internal network
unverified-webhook		7.5	CWE-345	Webhook handlers accepting events without signature checks
insecure-randomness		5.3	CWE-330	Math.random() for tokens/keys — predictable output

Data Exposure

Rule	Sev	CVSS	CWE	What it catches
api-data-overfetch		4.3	CWE-200	API returning full objects — extra fields in Network tab
console-data-leak		4.3	CWE-532	Sensitive data in console.log
insecure-error-handling		4.3	CWE-209	Stack traces leaked to users, silently swallowed errors
source-maps-exposed		3.7	CWE-540	Source maps shipping full source to production

Transport & Config

Rule	Sev	CVSS	CWE	What it catches
open-database-rules		9.8	CWE-284	Firebase/Firestore/Storage rules allowing public access
missing-csrf		6.5	CWE-352	State-changing routes with no CSRF protection
missing-rate-limiting		5.3	CWE-770	Paid API calls with no rate limiting
insecure-connections		5.3	CWE-319	HTTP URLs, disabled TLS, CORS wildcards
missing-security-headers		4.3	CWE-693	Missing CSP, HSTS, X-Frame-Options
insecure-cookies		4.3	CWE-614	Cookies missing httpOnly, secure, sameSite

Client-Side Trust

Rule	Sev	CVSS	CWE	What it catches
client-side-trust		5.3	CWE-602	Pricing / permission / validation logic only on the client
cors-credentials		5.3	CWE-942	credentials:true with reflected or permissive origin
no-pagination		4.3	CWE-770	List endpoints returning all records — scraping / DoS
debug-mode-exposed		3.7	CWE-489	Debug/dev mode exposing internal state in production

Bot & Auth Flow

Rule	Sev	CVSS	CWE	What it catches
unsafe-redirect		5.3	CWE-601	Unvalidated redirect URLs — phishing via auth flows
no-bot-protection		3.7	CWE-799	Signup with no CAPTCHA or bot detection
timing-attack		3.7	CWE-208	Token === comparison leaks timing info
predictable-ids		3.7	CWE-340	Auto-incrementing IDs enable enumeration

Framework-Specific — Next.js · Supabase · Firebase · Vercel · Netlify

Rule	Sev	CVSS	CWE	What it catches
supabase-missing-rls		9.8	CWE-284	Supabase tables that may lack Row Level Security
supabase-service-key-client		9.8	CWE-798	service_role key used in client code
firebase-admin-client		9.8	CWE-798	Firebase Admin SDK imported into the browser bundle
nextjs-server-action-exposure		8.6	CWE-306	Server Actions with no auth check
nextjs-middleware-bypass		7.5	CWE-863	Middleware matchers that leave routes unprotected
vercel-env-leak		7.5	CWE-200	Server-only secrets exposed via NEXT_PUBLIC_
supabase-anon-key-abuse		5.3	CWE-269	Anon key used for ops that need service_role
netlify-redirect-open		5.3	CWE-601	Open redirect / proxy patterns in Netlify config
nextjs-api-route-no-method-check		4.3	CWE-749	Pages Router API routes accepting all HTTP methods
deployment-config-insecure		4.3	CWE-16	Insecure settings in deployment config files

AI & API Security

Rule	Sev	CVSS	CWE	What it catches
ai-prompt-injection		8.6	CWE-77	User input passed into LLM prompts without sanitization
payment-amount-client		8.6	CWE-602	Payment amount taken from client instead of server
stripe-webhook-no-verify		8.1	CWE-345	Stripe webhooks without signature verification
ai-response-trusted		6.5	CWE-20	LLM output used in eval/innerHTML/SQL unsanitized
ai-cost-exposure		5.3	CWE-770	AI API calls with no token/spend limit

Data & Privacy

Rule	Sev	CVSS	CWE	What it catches
graphql-no-auth		8.6	CWE-306	GraphQL resolvers with no auth checks
missing-data-encryption		5.3	CWE-311	Sensitive data (SSN, card, etc.) stored unencrypted
graphql-depth-limit		5.3	CWE-770	GraphQL with no query depth/complexity limit
pii-logging		4.3	CWE-532	Personally identifiable info in logging statements
graphql-introspection		3.7	CWE-200	GraphQL introspection enabled in production

Session & Auth Hardening

Rule	Sev	CVSS	CWE	What it catches
oauth-state-missing		8.1	CWE-352	OAuth flow with no state param — login CSRF
session-fixation		7.5	CWE-384	Session ID not regenerated after login
mfa-bypass		6.5	CWE-287	MFA implementations that may be skippable
password-reset-weak		5.3	CWE-640	Predictable reset tokens or tokens without expiry
auth-token-no-expiry		5.3	CWE-613	JWT / auth tokens issued with no expiration

Expanded Coverage

Rule	Sev	CVSS	CWE	What it catches
nosql-injection		8.6	CWE-943	MongoDB query-operator injection / $where
xml-xxe		8.6	CWE-611	XML parsing vulnerable to XXE
ldap-injection		8.6	CWE-90	LDAP queries with unsanitized input
eval-usage		8.6	CWE-95	eval() / new Function() with dynamic args
command-injection		9.8	CWE-78	exec()/spawn() command built from interpolated input — RCE
unsafe-deserialization		9.8	CWE-502	unserialize() / vm.runIn* on untrusted input — RCE
template-injection		9.8	CWE-1336	Template engine compiling a template built from dynamic input — SSTI/RCE
missing-sri		4.3	CWE-353	External CDN <script>/<link> with no Subresource Integrity hash
unpinned-dependencies		5.3	CWE-829	Deps pinned to * / latest — npm pulls any version, no review
github-actions-injection		9.8	CWE-94	${{ github.event.* }} interpolated into a run: shell — RCE on your CI runner
supabase-public-bucket		5.3	CWE-284	Supabase Storage bucket created public: true — every file readable by URL
race-condition		8.1	CWE-362	Check-then-act without atomicity (TOCTOU)
dangerously-set-inner-html		6.1	CWE-79	React dangerouslySetInnerHTML with user content
header-injection		5.3	CWE-113	User input in HTTP response headers (CRLF)
subdomain-takeover		5.3	CWE-284	CNAME/subdomain refs vulnerable to takeover
regex-dos		5.3	CWE-1333	Regex vulnerable to catastrophic backtracking
clickjacking		4.3	CWE-1021	Missing X-Frame-Options / CSP frame-ancestors
hardcoded-ip		2.0	CWE-547	Hardcoded IPs that belong in env vars

Infrastructure

Rule	Sev	CVSS	CWE	What it catches
docker-root-user		6.5	CWE-250	Dockerfiles running containers as root
exposed-database-port		5.3	CWE-284	Database ports exposed to the host in compose files
serverless-fs-write		—	—	Filesystem writes / SQLite in serverless routes — ephemeral disk, data silently lost

Accessibility / WCAG

Level A checks that the automated scanners lawyers run (PowerMapper, axe, WAVE) flag. These carry a WCAG success criterion, not a CWE — accessibility is conformance, not a security weakness. An accessibility statement or overlay widget does not stop those scanners; real conformance does. Static analysis catches the low-hanging misses — pair with axe-core to verify screen-reader UX.

Rule	Sev	WCAG	What it catches
a11y-img-no-alt		1.1.1 (A)	<img> / next/image with no alt
a11y-form-no-label		1.3.1 (A)	Inputs with no associated label or aria-label
a11y-no-lang		3.1.1 (A)	<html> with no lang attribute
a11y-button-no-name		4.1.2 (A)	Buttons with no text and no aria-label
a11y-positive-tabindex		2.4.3 (A)	tabindex > 0 — breaks the keyboard tab order
a11y-click-no-keyboard		2.1.1 (A)	onClick on a non-interactive element with no keyboard handler

Scale / Performance

The real culprits behind the "$50k server bill" — named, not vibed. Quality/scale checks, not security findings, so they carry no CWE/OWASP. Missing DB indexes, caching, and connection pooling are not statically detectable — that judgment lives in the DA Pre-Flight Audit Prompt, not the scanner.

Rule	Sev	What it catches
perf-n-plus-one		A DB query inside a loop or .map/.forEach (the N+1 pattern)
perf-no-await-parallel		Sequential await in a loop that should run in parallel with Promise.all
perf-db-client-per-request		Pooled DB client (new PrismaClient(), pg Pool) created per-request — exhausts the connection pool

Observability

Rule	Sev	What it catches
no-error-monitoring		Web app with no error monitor (Sentry, Rollbar, Bugsnag…) — production errors fail silently

Dependencies (SCA)

Beyond the 98 rules above, Vibe Audit runs software composition analysis via npm audit to flag known-vulnerable dependencies (vulnerable-dependency, CWE-1035). Skip it with --skip-sca.

Run vibeaudit --list-rules for the complete, always-current list.

---

Copy-Paste Fix Prompts

Every finding includes a copy-paste prompt you can drop directly into your AI coding tool. Prompts include platform-specific notes for each tool's capabilities and limitations.

# Markdown report with fix prompts
npx @jackdog668/vibeaudit --format markdown > audit-report.md

# Show prompts in terminal + save VIBE-AUDIT-FIXES.md
npx @jackdog668/vibeaudit --fix

Supported Platforms

Platform	Type	Strengths	Limitations
Claude Code	Terminal IDE	Full file access, terminal, multi-file edits	—
Firebase Studio	Cloud IDE	Full IDE, terminal, Firebase integration	—
Cursor / Windsurf	Desktop IDE	Full file access, terminal, AI editing	—
Replit	Cloud IDE	Full IDE, terminal, package management	—
Google AI Studio	Chat	Code generation, prototyping	No direct file editing
Lovable	Chat builder	Component gen, backend functions	Limited file access
Base44	Chat builder	App builder, server functions	Limited infra control
Bolt / v0	Chat builder	Component generation, deployment	Limited server-side
Canva Code	Design tool	Frontend/design focused	No server-side, no secrets

---

Configuration

Drop a .vibe-audit.json in your project root:

{
  "ignore": ["legacy/", "vendor/"],
  "exclude": ["predictable-ids"],
  "format": "terminal",
  "strict": false,
  "customEscapers": ["myEscapeHtml"],
  "customAuthGuards": ["requireAuthedApiFromReq"],
  "disableForPaths": { "missing-auth": ["^public/"] }
}

Option	Type	Default	Description
ignore	string[]	[]	Extra directories to skip
rules	string[]	[]	Only run these rules (empty = all)
exclude	string[]	[]	Skip these rules
format	string	"terminal"	terminal, json, markdown, or html
strict	boolean	false	Exit 1 on warnings too
customEscapers	string[]	[]	Extra HTML escaper/sanitizer names that make innerHTML / dangerouslySetInnerHTML safe
customAuthGuards	string[]	[]	Extra auth-guard function names that satisfy missing-auth / server-action checks
disableForPaths	object	{}	Per-rule path patterns to skip, e.g. { "rule-id": ["^public/"] }

CLI flags override config file values.

Suppressing a finding

When a finding is a false positive, silence it inline with a comment — no config needed:

// vibe-audit-ignore-next-line missing-auth
export async function GET(req) { /* intentionally public */ }

const admin = createServiceRoleClient(); // vibe-audit-ignore supabase-service-key-client

A bare // vibe-audit-ignore (no rule id) suppresses every rule on that line; comma-separate ids to silence several.

Note on framework awareness: Vibe Audit understands Next.js App Router context. A file is treated as server by default — importing React does not make it "client." Server-only code (import 'server-only', route handlers, 'use server') is exempt from client-exposure rules, and auth guards imported from your own libs are recognized automatically.

---

CI / Pre-commit

GitHub Actions

- name: Security Audit
  run: npx @jackdog668/vibeaudit --format json --strict

Pre-commit Hook

# .husky/pre-commit
npx @jackdog668/vibeaudit --strict

Package Script

{
  "scripts": {
    "security": "vibeaudit --strict"
  }
}

---

CLI Reference

npx @jackdog668/vibeaudit [target] [options]

target   A local directory, OR a GitHub repo (owner/repo or full URL)

Options:
  -f, --format <terminal|json|markdown|html>  Output format
  -r, --rules   <id,id,...>                   Only run these rules
  -e, --exclude <id,id,...>                   Skip these rules
  -s, --strict                                Exit 1 on warnings too
      --deep                                  Also scan git history for secrets
      --skip-sca                              Skip dependency vulnerability scanning
      --fix                                   Show fix prompts + save VIBE-AUDIT-FIXES.md
      --fix-file                              Only save fix file (no terminal prompts)
      --list-rules                            Show all available rules
  -h, --help                                  Show help
  -v, --version                               Show version

---

Programmatic API

import { audit } from '@jackdog668/vibeaudit';

const { findings, exitCode } = await audit('/path/to/project', {
  format: 'json',
  strict: true,
});

console.log(`Found ${findings.length} issues`);

---

Design Principles

AST-powered analysis. The highest-impact rules (IDOR, mass assignment, missing auth, N+1 queries) use acorn to parse your code into an Abstract Syntax Tree and analyze it per-function. This means we can tell the difference between "this function checks ownership" and "some other function in the file does" — a distinction regex alone can't make.

Minimal dependencies. Two production dependencies: acorn (the parser behind ESLint and webpack) and acorn-loose (tolerant parsing for AI-generated code that may have syntax quirks). No bloated dependency tree.

Industry-standard metadata. Every security rule is mapped to a CWE ID, a CVSS v3.1 base score, and an OWASP Top 10 (2021) category. Accessibility rules carry a WCAG success criterion, and scale/performance rules are quality checks — all surfaced in every output format.

Zero false positives over catching everything. A rule that cries wolf gets disabled. Every pattern is tuned to minimize noise. Clean code triggers zero findings (verified by regression tests on a fully-secured fixture).

Every finding includes a fix AND a prompt. Plain-English explanation for understanding PLUS a copy-paste prompt for action. No "go read the OWASP docs."

It audits itself. npm run audit:self — Vibe Audit passes its own checks in strict mode. 174+ tests, all passing.

---

Roadmap

• DAST (Phase 2) — dynamic scanning stubs for ZAP + Nuclei are in place for live-endpoint testing.

---

Contributing

See CONTRIBUTING.md. Adding a new rule is straightforward — each one is a self-contained module with a simple interface.

---

License

MIT — Digital Alchemy Academy

Built by Digital Alchemy Academy. Teaching the security-first approach to vibe coding.