Show HN: VibeGuard – security linter for AI-generated code
VibeGuard is an open-source security linter specifically designed to detect vulnerability patterns commonly produced by AI coding assistants like GitHub Copilot, Cursor, Claude, and ChatGPT It ships with 47 AI-pattern rules derived from studying actual AI-generated code, covering SQL injection, hardcoded secrets, command injection, JWT bypasses, XXE, path traversal, and more Unlike traditional linters (Bandit, Semgrep) that use generic rules, VibeGuard's rules are tailored to the specific anti-p
Analysis
TL;DR
- VibeGuard is an open-source security linter specifically designed to detect vulnerability patterns commonly produced by AI coding assistants like GitHub Copilot, Cursor, Claude, and ChatGPT
- It ships with 47 AI-pattern rules derived from studying actual AI-generated code, covering SQL injection, hardcoded secrets, command injection, JWT bypasses, XXE, path traversal, and more
- Unlike traditional linters (Bandit, Semgrep) that use generic rules, VibeGuard's rules are tailored to the specific anti-patterns AI tools repeatedly produce
- The tool provides a letter-grade scoring system (A–F), plain English fix recommendations for every finding, and supports CI/CD integration with configurable exit codes
- VibeGuard is Python-based (requires 3.10+), offers CLI and planned VS Code extension, and accepts community-contributed rules via a straightforward pattern registration system
Why It Matters
AI coding assistants are becoming ubiquitous in software development, but their training on vulnerable code repositories means they systematically reproduce security flaws at scale—outpacing traditional security review processes. VibeGuard addresses a critical gap in the DevSecOps toolchain by providing security-specific detection rules purpose-built for AI-generated code patterns, enabling teams to integrate targeted security gates into their CI/CD pipelines without extensive configuration.
Technical Details
- Rule Engine: 47 custom rules written as regex and AST-based checks in
vibeguard/rules/patterns.py, each annotated with name, description, severity level, the AI tool most likely to produce it, and a plain English remediation suggestion - Detected Vulnerability Classes: SQL injection via f-strings/concatenation, command injection via
shell=True, hardcoded secrets detected by entropy analysis,alg:noneJWT bypass, XXE injection, path traversal, insecure deserialization (pickle/YAML), weak cryptography (MD5/SHA1/ECB), debug mode in production, CORS wildcard origins, and insecure random generation - Scoring System: Letter grades A through F based on weighted severity counts—A (90–100, no high/critical), B (75–89), C (60–74), D (40–59, high severity present), F (0–39, critical findings require immediate action)
- Integration & Output: CLI tool with
--cimode for pipeline integration,--fail-onseverity thresholds, JSON report output, and a GitHub Actions workflow template provided for automated scanning on push/PR events - Architecture: Python package with modular rule definitions, extensible rule-adding process, and a planned VS Code extension; compares directly against Bandit and Semgrep on AI-specific pattern detection and usability features
Industry Insight
- Organizations adopting AI coding assistants should treat VibeGuard-style tools as a necessary complement to existing linters, not a replacement—generic security scanners will miss the systematic, AI-specific vulnerability patterns that emerge at scale
- The letter-grade reporting model is a practical innovation for bridging the communication gap between security teams and AI-augmented developers, translating technical findings into actionable, prioritized remediation guidance
- As AI-generated code becomes a dominant source of new codebases, expect specialized security tooling to emerge along similar lines for other languages and AI platforms, making AI-pattern-aware security scanning a standard requirement in DevSecOps pipelines rather than an optional add-on
Disclaimer: The above content is generated by AI and is for reference only.