A local-first security orchestration layer, pipeline, and Dashboard for AI-assisted software.
v0.4.0-alpha · Early Alpha / Active Development · macOS tested
AI coding is fast. Security tooling is fragmented.
Vibe Code Guard does not invent a new vulnerability scanning engine. It brings existing open-source security tools into one local, change-aware pipeline and Dashboard.
The scanners find the problems. Vibe Code Guard makes the security workflow usable.
Static fallback: view the PNG export.
Vibe Code Guard combines the capabilities of established open-source security tools into one understandable local workflow for AI-generated and “vibe-coded” projects.
It is not a new scanner and it does not replace the upstream projects. It is the layer around them that understands project context, coordinates the checks, normalizes scanner results into one Unified Finding Schema, and brings findings, execution state, run history, and the local Dashboard into one workflow. Cross-tool correlation and persistent finding lifecycle are now included; automated fix/rescan workflow remains a planned milestone:
- understands what changed in a repository;
- classifies the change and applies safe scanning policies;
- selects the relevant checks instead of blindly running everything every time;
- executes independently installed upstream tools;
- collects execution evidence, findings, and skip reasons; and
- presents the result in a local Dashboard with history and a conservative release-gate summary; and
- stores scanner-independent Unified Findings for the CLI, Dashboard, reports, and a project-level correlation and lifecycle index.
The goal is simple: install the security toolkit once, then use the same repeatable security workflow in every AI-assisted coding repository.
| Responsibility | |
|---|---|
| Upstream open-source tools | Detect vulnerabilities, secrets, insecure code, dependency issues, infrastructure misconfigurations, and authorized web/runtime signals. They provide the actual scanning engines. |
| Vibe Code Guard | Understands project and change context; decides which scanners are relevant; orchestrates the pipeline; normalizes results into the v1 Unified Finding Schema; correlates compatible evidence; tracks explicit fix and verification lifecycle; records execution state and run history; presents the local Dashboard and reports; and provides a conservative release gate. Automated fix/rescan remains planned. |
Vibe Code Guard does not claim the upstream detection engines as its own work. The individual tools remain responsible for their own scanning behavior and licenses.
AI-assisted development makes it easy to create features quickly, but it also creates a practical security gap:
- Security tools are fragmented. Each scanner has its own installation, command syntax, output format, database, rules, and update process.
- Developers do not know which check fits the change. A dependency change, API change, secret leak, Dockerfile, and web application need different kinds of review.
- Running every scanner on every edit is slow. Running none of them leaves blind spots.
- Raw findings are difficult to act on. A list of tool-specific alerts does not clearly show what ran, what was skipped, what matters, or whether a fix actually remained fixed.
- Active testing needs a boundary. Web scanners and agentic testing tools must not accidentally target third-party systems.
- Toolchain health is easy to forget. An outdated binary, missing database, broken rule set, or failed self-test can make a security workflow look more complete than it really is.
Vibe Code Guard turns those separate concerns into one visible, local, and repeatable security path.
The core toolkit covers several independent detection layers:
| Security layer | Open-source tool | What it contributes | License |
|---|---|---|---|
| Secrets | Gitleaks | Detects likely secrets in source and Git history | MIT |
| Secrets | TruffleHog | Searches for credentials and verifies exposed secrets where supported | GNU AGPL v3 — see upstream LICENSE |
| Static analysis | Semgrep | Finds insecure code patterns using configurable rules | LGPL-2.1 |
| Vulnerabilities and config | Trivy | Scans dependencies, filesystems, containers, secrets, and configuration | Apache-2.0 |
| Dependencies | OSV-Scanner | Matches supported dependency manifests and lockfiles to OSV vulnerabilities | Apache-2.0 |
| Infrastructure as code | Checkov | Checks Terraform, Dockerfiles, Kubernetes, and other IaC policies | Apache-2.0 |
| Authorized web testing | OWASP ZAP | Dynamic web application testing for authorized local/test targets | Apache-2.0 |
| Authorized template detection | Nuclei | Template-driven detection against explicitly authorized targets | MIT |
| Detection content | Nuclei Templates | Community-curated detection content used by Nuclei | MIT |
| Optional agentic testing | Strix | Explicitly authorized deep testing and exploit validation | Apache-2.0 |
Strix is not part of the deterministic eight-tool core health gate and is
never invoked implicitly by quick or full.
This is composition at the workflow layer, not a combined binary or a fork. The repository does not copy, bundle, modify, or redistribute the upstream scanners, their binaries, databases, rules, templates, or add-ons. They are independently installed and managed through their own official channels. This repository does not relicense them or claim them as its own work.
The pipeline separates everyday development checks from deeper pre-release review:
repository change
↓
detect files, stack, and risk
↓
apply policy and choose relevant checks
↓
run local upstream scanners
↓
parse the current run and explain findings
↓
record execution state and run history
↓
planned: fix → regression test → targeted rescan
↓
human review and conservative release gate
The intended operating pattern is:
| Moment | Command | Typical scope |
|---|---|---|
| During development | security-check quick . |
Secrets, static analysis, and dependency checks |
| Before release | security-check full . |
Broader code, dependency, and infrastructure checks |
| For a changed project | security-check auto . |
Change-aware selection with an explanation for every run or skip |
Full installation does not mean full scanning on every edit. The toolkit can be installed once globally, while the pipeline chooses a proportionate set of checks for the current change.
The Dashboard gives developers a visual audit trail instead of forcing them to read several unrelated terminal outputs. It shows:
- which scanners actually ran;
- installed tool and toolchain health;
- findings and their evidence;
- explicit skip and not-applicable reasons;
- scan history and current run/rescan evidence; and
- a conservative release-gate summary.
The current Dashboard reads the v1 Unified Finding Schema and presents correlated issues with scanner observations and explicit lifecycle actions. It does not automatically fix code or run a rescan after a fix. See the Unified Finding Schema documentation and correlation and lifecycle documentation for the field contracts and compatibility rules.
The Dashboard is local-only by default. It binds to 127.0.0.1, does not
require an account or cloud database, and does not upload source code or scan
results. It observes and explains scanner execution; it does not manufacture
findings or pretend that a skipped check passed. v0.4 adds an optional,
explicitly triggered AI Security Review that explains selected redacted
Correlated Finding context; it remains advisory and cannot change deterministic
security state. See AI Security Review documentation.
The repository does not silently install scanners. Use each upstream project's official installation instructions. A typical macOS setup for commonly available CLI packages is:
brew install gitleaks trufflehog semgrep trivy osv-scanner nuclei
brew install --cask owasp-zapInstall Checkov using its official Python packaging instructions, preferably in
an isolated pipx environment. Then verify the toolkit:
security-tools doctor
security-tools self-testgit clone https://github.com/DOTfei/vibe-code-guard
cd vibe-code-guard
npm install
npm test
npm run install:orchestratorThe installer copies only this project's orchestration modules to
$SECURITY_TOOLKIT_HOME/orchestrator (default:
$HOME/security-toolkit/orchestrator). It does not install scanners,
templates, databases, credentials, or binaries.
Then, inside any repository you are authorized to review:
security-check quick .
# or
security-check full .
# or
security-check auto .npm startOpen http://127.0.0.1:4567.
Optional configuration:
PORT=4567
SECURITY_TOOLKIT_HOME="$HOME/security-toolkit"
SECURITY_DASHBOARD_DATA_DIR="$HOME/security-toolkit/runs"
SECURITY_TOOL_PATHS="$HOME/bin"
SECURITY_TOOL_BINARIES='{"zap":"/path/to/zap.sh"}'AI review is disabled by default. For a deterministic local demonstration only, enable the synthetic provider explicitly:
SECURITY_AI_PROVIDER=mock npm startThe safe CLI equivalent for reviewing an existing local run is:
npm run ai-review -- --run-dir "$SECURITY_DASHBOARD_DATA_DIR/<run-id>" --finding VCG-CORR-...No scanner or combination of scanners can guarantee that software is vulnerability-free. Vibe Code Guard is an early-alpha engineering aid, not a security warranty, certification, or substitute for qualified human review.
Active testing is restricted by design:
- ZAP and Nuclei default to localhost, local Docker, or explicitly configured authorized test/staging targets.
- Strix requires an explicit decision about the target, command, Docker, and any external LLM data flow.
- Never scan a third-party system without clear authorization.
- Never use real credentials or destructive payloads in self-tests.
- Nuclei templates and other executable security content must come from trusted sources and retain their security/signature controls.
External scanners may contact upstream services for vulnerability databases, rules, templates, or add-ons. Review their individual network behavior and terms for your environment.
The original orchestration, Dashboard, policy, test, and documentation code in this repository is licensed under the Apache License 2.0.
The scanners listed above remain separate works owned by their respective authors and organizations. Their licenses are not replaced by this repository's Apache-2.0 license. The current integration invokes independently installed tools through explicit adapters and allowlists; it does not link against or redistribute their code or binaries.
The listed licenses apply to the upstream repositories themselves. Rule packs, templates, vulnerability databases, plugins, add-ons, model assets, and other downloaded artifacts may have their own terms and must be reviewed separately before use or redistribution.
For every integrated upstream project, the repository records:
- project name and official repository;
- license identifier and upstream license URL;
- integration boundary;
- whether the project is bundled or modified; and
- attribution and notice requirements.
See THIRD_PARTY_NOTICES.md for the human-readable
notice and license table, ATTRIBUTIONS.md for project
credits, third-party/tools.json for portable
machine-readable metadata, and
security-toolchain.lock for the tracked toolchain
record.
Important licensing boundary: TruffleHog is described here as “GNU AGPL v3 — see upstream LICENSE” and Semgrep as LGPL-2.1. If this project ever bundles, links to, modifies, embeds, packages, or redistributes any upstream tool, rule, template, database, add-on, or dependency, the licensing analysis must be repeated and the applicable notices must be shipped. Do not assume that a tool's repository license covers every artifact it downloads or uses.
The README architecture diagram was exported with Next AI Draw.io, which is an external documentation tool and is licensed under Apache-2.0. Its source code, binary, and runtime are not bundled or used by the Dashboard.
This documentation is a compliance record and is not legal advice. Before distributing a combined binary, installer, container image, hosted service, or commercial product, obtain a proper license and trademark review and check the current upstream notices. Keep upstream copyright, trademark, and license notices intact.
Current early-alpha capabilities:
- deterministic change detection, risk classification, policy evaluation, and tool selection;
quick,full, and change-awareautoplans;- v1 Unified Findings across the supported scanners, with redaction and stable fingerprints;
- normalized Dashboard and Markdown report presentation;
- scanner execution state, run history, and tool health;
- deterministic cross-scanner correlation, project-level observations, and
explicit
OPEN/FIXED/VERIFIED/REOPENED/FALSE_POSITIVE/ACCEPTED_RISKlifecycle states; - localhost-focused active-testing boundaries; and
- safe synthetic self-test fixtures.
- advisory AI Security Review with provider abstraction, bounded redacted context, schema validation, local caching, and stale-review detection.
Planned milestones, not current promises:
- v0.2 — Unified Findings: one normalized schema for every scanner result ✅;
- v0.3 — Correlation + Lifecycle: cross-tool deduplication and open/fixed/verified/reopened tracking ✅;
- v0.4 — AI Security Review: plain-language explanation of what the scanners found, including likely false positives ✅;
- v0.5 — GitHub PR Review: PR summaries and findings tied to a pull request;
- v0.6 — Fix → Rescan Automation: controlled fix, regression test, and targeted rescan;
- v0.7 — Optional Strix Deep Audit: explicit, authorized agentic testing;
- v1.0 — Stable Security Review Platform: after broader testing, review, and documentation.
Vibe Code Guard's own scope remains the orchestration flow, not the scanners. Every roadmap item above is a workflow or presentation layer on top of independently maintained upstream projects.
The first diagram is the README's main product explanation. It shows the division of responsibility between Vibe Code Guard and the upstream scanning engines, plus the workflow outputs users see.
-
Main product explainer: Next AI Draw.io animated SVG · draw.io source · Mermaid · Excalidraw · Next AI Draw.io PNG export · Mermaid PNG render
-
Detailed implementation flow: GIF · Next AI Draw.io animated SVG · draw.io source · Mermaid · Excalidraw
The diagrams describe this repository's own architecture. The draw.io source can be refined with Next AI Draw.io; no upstream source code, binary, or runtime dependency is bundled here.
orchestrator/ change detection, policy, risk, and tool selection
core/findings/ Unified Finding schema, sanitization, fingerprints, adapters
public/ local Dashboard assets
docs/ schema and implementation documentation
test/ unit tests and safe orchestration fixtures
scripts/ installation helpers
third-party/ portable upstream integration metadata
The repository intentionally does not contain scanner binaries, vulnerability databases, secret rules, Nuclei templates, ZAP sessions, credentials, or private project data.
See CONTRIBUTING.md for development expectations and
SECURITY.md for private vulnerability reporting. Please do
not publish credentials, sensitive logs, private source, or exploit details in
public issues.
Original code in this repository: Apache License 2.0.
Third-party projects and artifacts: separate upstream licenses and notices as described above. Vibe Code Guard does not claim authorship of, or ownership over, those projects.