{"slug": "i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects", "title": "I built a small open-source scanner for API-key mistakes in vibe-coded projects", "summary": "A developer built Wardrail, an open-source scanner that checks for API-key leaks and security risks in vibe-coded projects. The tool scans Git history, MCP configuration, and Agent instruction files for exposed secrets and risky patterns, running locally without uploading code.", "body_md": "I started this project because vibe coding makes it possible to get an app\n\nworking before a beginner has learned how secrets, frontend bundles, or Git\n\nhistory behave.\n\nA value being in `.env`\n\ndoes not always mean it stays private. Variables such\n\nas `VITE_*`\n\n, `NEXT_PUBLIC_*`\n\n, and `REACT_APP_*`\n\ncan reach browser code. And if\n\nan API key was committed, deleting it from the current file does not remove it\n\nfrom Git history.\n\nSo I built **Wardrail**, a small open-source safety check:\n\n```\nnpx wardrail scan --history\n```\n\nIt scans the current project and a bounded part of Git history. It also checks\n\nMCP configuration and Agent instruction files for risky commands, credential\n\naccess, and safety-bypass patterns.\n\nWardrail runs locally by default. It does not upload source code and does not\n\nexecute the project being scanned.\n\n`wardrail@0.3.0`\n\nAI coding tools can help someone ship a useful application very quickly. But\n\nspeed can hide security assumptions:\n\n`.env`\n\nis treated as automatically privateWardrail is meant to be an early warning before a push or release. It explains\n\nthe matched evidence and suggests a fix instead of returning only a risk\n\nscore.\n\nThis is still an early project, and I do not have external users to point to\n\nyet. It can produce false positives and miss risks. It is not a penetration\n\ntest, and a clean report does not mean an application is secure.\n\nIt does not currently test authentication, authorization, database policies,\n\ndependency vulnerabilities, deployment settings, or runtime behavior.\n\nGitleaks and TruffleHog are still mature choices for broader secret discovery.\n\nRepository and CLI demo:\n\n[https://github.com/3196973848/wardrail](https://github.com/3196973848/wardrail)\n\nThe feedback that would help most is:\n\nPlease share only a rule ID and a redacted example—never post a live\n\ncredential. If a real key may have been exposed, revoke or rotate it first.\n\nEven a short report about what failed is more useful to me than a polite\n\n\"looks cool.\"", "url": "https://wpnews.pro/news/i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects", "canonical_source": "https://dev.to/3196973848/i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects-4cd0", "published_at": "2026-07-30 05:15:06+00:00", "updated_at": "2026-07-30 06:00:00.789398+00:00", "lang": "en", "topics": ["developer-tools", "ai-safety", "ai-agents"], "entities": ["Wardrail", "Gitleaks", "TruffleHog"], "alternates": {"html": "https://wpnews.pro/news/i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects", "markdown": "https://wpnews.pro/news/i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects.md", "text": "https://wpnews.pro/news/i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects.txt", "jsonld": "https://wpnews.pro/news/i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects.jsonld"}}