Show HN: SecureVibe – Find and trace vulnerabilities before shipping

A developer released SecureVibe, an MVP security scanner that uses Tree-sitter and abstract syntax trees to build a graph of application routes, handlers and database calls and classify findings as confirmed or likely. SecureVibe reports a raw F1 score of 77.5 on the OpenSSF CVE benchmark, and the developer said false positives remain a problem. The tool offers AI-assisted fixes with a user-supplied API key, vulnerability filtering by CWE and database injection categories, an interactive HTML report export, and a "ask the graph" feature built on graphify; it is intended to start with TypeScript repositories.

Hello HN, just wanted to share my project that I've been working on the past months, where I noticed the issue that now we ship faster than setting up the requirements for the project. So I thought of building secureVibe to find vulnerabilities in your codebase. Now I have a MVP where it doesn't just scan the code and show random analysis I used Tree-sitter and AST to understand code context to validate vulnerabilities found as it builds a graph of application routes, handlers and database calls so it helps to determine whether findings are confirmed or likely. Briefly the features: 1- shows all vulnerabilities in your code with code snippets 2-fixing with ai option optional with your own api key for now 3- ask the graph feature as you can ask where the attacker can exploit my website or authentication issues I used graphify as foundation for it 4- You can filter vulnerabilities categories like Cwe, database injection and more from dashboard and you can download it as html report simple interactive one so you can fix it on your own later. I would love to know your thoughts and feedback to continue on the development on it like some of the problems I faced is benchmarks to validate security rules. With some research I found openssf benchmark On the OpenSSF CVE benchmark, the raw F1 score was 77.5, but still I face some issues with false positive so would really appreciate feedback to continue on developing with next phases. Even though with these issues Its still working well, it is efficient and fast and preferably start with TypeScript repos first for it. Comments URL: https://news.ycombinator.com/item?id=50507205 https://news.ycombinator.com/item?id=50507205 Points: 1 Comments: 0