Offline security scorecard for vibe-coded projects
Scan local code, see a protection score, export fixes for your AI assistant.

Features · Quick Start · How it works · Roadmap · License

Vibe coding is fast — shipping insecure apps is faster. VibeGuard helps indie builders and teams catch the obvious (and not-so-obvious) weak spots before release:

• secrets committed by accident
• dangerous JS/TS patterns (eval, XSS sinks, weak crypto)
• risky dependencies and install scripts
• Python pitfalls (pickle, yaml.load, shell=True)
• auth / CORS / TLS misconfigurations

Results come as a clear % protection score, a prioritized findings list, and exports you can paste into Cursor or ChatGPT.

Website URL and application (.exe / .apk) engines are scaffolded and coming next. Code folder scanning is live today.

Try the intentional leaky sample:

fixtures/leaky-demo

It contains fake keys, unsafe scripts, SQL concatenation, weak hashing, and unsafe Python — perfect for verifying the scanner.

Download the latest NSIS installer from Releases:

1. Run VibeGuard_0.1.0_x64-setup.exe
2. Accept the MIT license on the installer page
3. Launch VibeGuard from the Start Menu

If SmartScreen / antivirus warns on first run, see SECURITY.md. Prefer builds only from this GitHub repository and verify the SHA-256 when provided.

npm install
npm run tauri:build

Output (Windows):

src-tauri/target/release/bundle/nsis/VibeGuard_*_x64-setup.exe

• Node.js 20+
• Rust (rustup) — for the desktop shell
• Windows: Visual Studio Build Tools with C++ workload (link.exe)

git clone https://github.com/Dente22/VibeGuard.git
cd VibeGuard
npm install
npm run tauri:dev

Windows shortcut: double-click start-vibeguard.bat
(it wires cargo PATH + MSVC tools for you)

npm run dev

Note: full code scanning needs the desktop app so VibeGuard can read local folders.

npm run tauri:build

Project folder
     │
     ▼
 Rust walker (skip node_modules / .git / dist / …)
     │
     ▼
 TypeScript engines
   ├─ secrets & credentials
   ├─ dependencies / lockfiles / risky scripts
   ├─ injection / crypto / auth / network rules
   ├─ JS/TS AST review (Babel)
   └─ Python heuristics
     │
     ▼
 Score %  +  findings  +  export (MD / JSON / PDF / AI clipboard)

Everything stays on-device. VibeGuard does not upload your source.

src/                 React UI + scan engines
src-tauri/           Tauri / Rust backend (file walk, dialogs)
docs/brand/          Logo & brand assets
fixtures/leaky-demo  Sample vulnerable project
start-vibeguard.bat  One-click Windows launcher

• Desktop shell (Tauri + React + TS)
• Offline code scanner (rules + AST + Python)
• Native export (Markdown / JSON / printable PDF flow)
• Passive website checks (headers, TLS, CORS)
• Application package inspection (.exe / .apk metadata)
• Deeper dependency CVE database (still offline-first)
• Donation link / sponsorship

See also VISION.md for product decisions.

Issues and PRs are welcome.

1. Fork the repo
2. Create a branch (feat/…, fix/…)
3. Open a pull request with a short “why”

Please keep scans offline-first and avoid shipping exploit payloads — defensive findings and fixes only.

MIT © VibeGuard contributors

Free to use. Donations may be added later — no paywall planned for core scanning.

_{Ship the vibe. Guard the gaps.}