{"slug": "show-hn-vibeguard-security-linter-for-ai-generated-code", "title": "Show HN: VibeGuard – security linter for AI-generated code", "summary": "VibeGuard v1.0.0, a security linter built specifically for AI-generated code, has been released on GitHub by developer zeroFhacker. The tool runs 47 AI-pattern rules to detect vulnerabilities commonly produced by AI coding assistants like GitHub Copilot, Cursor, Claude, and ChatGPT, including SQL injection, hardcoded secrets, and command injection. It assigns a letter grade (A–F) and provides plain-English fixes, with features such as CI/CD mode and exit codes, distinguishing it from traditional linters like Bandit and Semgrep.", "body_md": "AI coding assistants — GitHub Copilot, Cursor, Claude, ChatGPT — write code fast. Really fast. Faster than any security review can keep up with.\n\nThe problem is they also confidently produce the same security mistakes over and over. Not because they are bad tools. Because they were trained on millions of code examples — and millions of those examples had security vulnerabilities in them.\n\n**The exact mistakes AI coding assistants make repeatedly:**\n\n- SQL queries built with string concatenation instead of parameterized queries\n- Secrets and API keys hardcoded directly into source files\n- User input passed to\n`eval()`\n\n,`exec()`\n\n,`subprocess.shell=True`\n\nwithout validation - JWT tokens verified without checking the algorithm — the\n`alg:none`\n\nbypass - XML parsers configured to allow external entities — XXE vulnerabilities\n- Insecure random number generation used for security-sensitive values\n- Path traversal — user-controlled file paths with no sanitization\n- CORS configured to accept any origin\n- Debug mode left enabled in production configuration\n- Pickle deserialization of untrusted data — remote code execution\n\nTraditional linters like Bandit and Semgrep catch some of these. But they use generic rules that were not built around the specific patterns AI tools produce. VibeGuard is different — every rule was written by studying actual AI-generated code and cataloguing the exact vulnerability patterns these tools produce.\n\n``` bash\n$ vibeguard scan --path ./my-ai-generated-project\n\n[*] VibeGuard v1.0.0 — AI-Generated Code Security Linter\n[*] Scanning: ./my-ai-generated-project\n[*] Running 47 AI-pattern rules...\n\napp/database.py:34     CRITICAL  SQL_INJECTION      f-string used in SQL query — classic Copilot pattern\napp/auth.py:12         CRITICAL  HARDCODED_SECRET   API key assigned to variable — detected by entropy\napp/utils.py:89        HIGH      COMMAND_INJECTION   subprocess called with shell=True + user input\napp/api.py:156         HIGH      JWT_ALG_NONE        JWT decoded without algorithm verification\nconfig/settings.py:8   HIGH      DEBUG_PRODUCTION   DEBUG=True in production settings file\napp/files.py:44        MEDIUM    PATH_TRAVERSAL      User input used in file path without sanitization\napp/xml_parser.py:23   MEDIUM    XXE_INJECTION       XML parser allows external entities\n\n[*] Grade: D  (7 findings — 2 critical, 3 high, 2 medium)\n[*] Report saved to vibeguard-report.json\n\nFix these first:\n  app/database.py:34 → Use cursor.execute(query, params) instead of f-strings\n  app/auth.py:12     → Move to environment variable: os.environ.get('API_KEY')\n```\n\n| Feature | VibeGuard | Bandit | Semgrep |\n|---|---|---|---|\n| Rules built from AI code patterns | ✅ | ❌ | ❌ |\n| Letter grade (A–F) | ✅ | ❌ | ❌ |\n| Plain English fix for every finding | ✅ | Partial | Partial |\n| Detects AI-specific anti-patterns | ✅ | ❌ | ❌ |\n| Zero configuration to start | ✅ | ✅ | ❌ |\n| CI/CD mode with exit codes | ✅ | ✅ | ✅ |\n| VS Code extension | Roadmap | ❌ | ✅ |\n\n**Developers** using Copilot, Cursor, Claude, or ChatGPT to write code**Security engineers** reviewing AI-generated pull requests**Engineering teams** who have adopted AI coding tools and want automated security checks**DevSecOps teams** who want AI-specific security gates in their CI/CD pipeline**Students** learning about the security implications of AI-generated code\n\n```\npython3 --version\n```\n\nYou need version 3.10 or higher.\n\n```\ngit --version\n# Clone the repo\ngit clone https://github.com/zeroFhacker/vibeguard.git\ncd vibeguard\n\n# Create virtual environment\npython3 -m venv venv\nsource venv/bin/activate   # Windows: venv\\Scripts\\activate\n\n# Install\npip install -r requirements.txt\nPYTHONPATH=. python -m vibeguard.cli scan --path ./my-project\nPYTHONPATH=. python -m vibeguard.cli scan --path ./app/database.py\nPYTHONPATH=. python -m vibeguard.cli scan --path . --ci --fail-on high\nPYTHONPATH=. python -m vibeguard.cli scan --path . --severity critical\nPYTHONPATH=. python -m vibeguard.cli scan --path . --output report.json\nPYTHONPATH=. python -m vibeguard.cli rules list\n```\n\n- SQL injection via f-string or concatenation\n- Command injection via shell=True\n- LDAP injection\n- XPath injection\n- Template injection\n\n- API keys assigned to variables\n- Hardcoded passwords in source\n- AWS/GCP/Azure credentials in code\n- Private keys in source files\n- Database connection strings with credentials\n\n- JWT decoded without algorithm verification\n- JWT secret hardcoded\n- Weak session secret\n- Missing authentication on sensitive endpoints\n- Insecure password hashing (MD5, SHA1)\n\n- Path traversal via user-controlled file paths\n- XML external entity injection\n- Eval/exec with user input\n- Pickle deserialization of untrusted data\n- YAML load instead of safe_load\n\n- Debug mode enabled in production\n- CORS wildcard origin\n- Insecure cookie settings (no HttpOnly, no Secure)\n- Weak TLS configuration\n- Default admin credentials\n\n- MD5 used for security-sensitive hashing\n- SHA1 used for security-sensitive hashing\n- Weak random (random module) for security values\n- ECB mode encryption\n- Hardcoded encryption key\n\nAdd to `.github/workflows/security.yml`\n\n:\n\n```\nname: VibeGuard Security Scan\n\non: [push, pull_request]\n\njobs:\n  vibeguard:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-python@v4\n        with:\n          python-version: '3.11'\n      - run: pip install -r requirements.txt\n      - name: Run VibeGuard\n        run: |\n          PYTHONPATH=. python -m vibeguard.cli scan \\\n            --path . \\\n            --ci \\\n            --fail-on high \\\n            --output vibeguard-report.json\n      - name: Upload report\n        uses: actions/upload-artifact@v4\n        with:\n          name: vibeguard-security-report\n          path: vibeguard-report.json\n```\n\n| Grade | Score | What It Means |\n|---|---|---|\n| A | 90–100 | Excellent — no high or critical findings |\n| B | 75–89 | Good — minor issues only |\n| C | 60–74 | Needs attention — several medium findings |\n| D | 40–59 | Poor — high severity findings present |\n| F | 0–39 | Critical — immediate action required |\n\nNew AI-pattern rules are always welcome. To add a rule:\n\n- Add a\n`RulePattern`\n\nto`vibeguard/rules/patterns.py`\n\n- Write the regex or AST check\n- Include: name, description, severity, AI tool that commonly produces this, plain English fix\n- Add a test in\n`tests/test_rules.py`\n\nSee `CONTRIBUTING.md`\n\nfor full guidance.\n\nMIT — see [LICENSE](/zeroFhacker/vibeguard/blob/main/LICENSE)\n\nPart of the open-source security toolkit at [github.com/zeroFhacker](https://github.com/zeroFhacker)", "url": "https://wpnews.pro/news/show-hn-vibeguard-security-linter-for-ai-generated-code", "canonical_source": "https://github.com/zeroFhacker/vibeguard", "published_at": "2026-08-29 23:04:03+00:00", "updated_at": "2026-08-29 23:18:17.517842+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "developer-tools"], "entities": ["VibeGuard", "GitHub Copilot", "Cursor", "Claude", "ChatGPT", "Bandit", "Semgrep", "zeroFhacker"], "alternates": {"html": "https://wpnews.pro/news/show-hn-vibeguard-security-linter-for-ai-generated-code", "markdown": "https://wpnews.pro/news/show-hn-vibeguard-security-linter-for-ai-generated-code.md", "text": "https://wpnews.pro/news/show-hn-vibeguard-security-linter-for-ai-generated-code.txt", "jsonld": "https://wpnews.pro/news/show-hn-vibeguard-security-linter-for-ai-generated-code.jsonld"}}