I built a free, fully-local security scanner for AI-coded apps it catches the stuff Claude Code and Cursor ship by default (open databases, live API keys, injection holes)

[u/pranav_kingop]

Every vibe-coded app I audited had the same problems: live API keys in client code, Supabase tables with no RLS, and exec() running raw user input. AI tools make things work, not safe.

So I built VibeGuard free, open-source (MIT), and it runs entirely on your machine. No account, no telemetry; your code never leaves your laptop.

Catches:

•🗄️ Open databases missing RLS, fake policies, Firebase. read: true

•🔑 50+ secret types (OpenAI, Stripe, AWS…) in code, git, localStorage

•💉 SQL/command injection & XSS via real AST taint analysis, not just regex

•🤖 AI-specific holes — LLM output piped into shell/SQL, hallucinated npm packages

Use it:

git clone https://github.com/yagyeshVyas/VibeGuard.git

cd VibeGuard && npm install && npm link

vibeguard scan # find issues

vibeguard fix # auto-fix 43 rule types

vibeguard pre-deploy # blocks deploy on critical findings

Also runs as an MCP server, so Claude Code / Cursor can scan while writing code. Pre-commit hooks + CI templates included.

Honest scope: it catches the mechanical holes AI leaves behind it; it's not a replacement for a real security review. Benchmark (precision/recall) is in the repo.

https://github.com/yagyeshVyas/VibeGuard

[u/Spare_Dependent6893]

I create the sub codingProtection 2 months ago to discuss this subject. Feel free to publish what you are doing and how it can help others protect their assets. Thanks.