Skip to content

Commit 6491909

Browse files
slowcoder360slowcoder360
committed
feat: Implement VibeSafe MVP
0 parents  commit 6491909

22 files changed

+2443
-0
lines changed

‎.github/workflows/ci.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
branches: [ master ]
8+
9+
jobs:
10+
build_and_scan:
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- uses: actions/checkout@v4
15+
16+
- name: Set up Node.js
17+
uses: actions/setup-node@v4
18+
with:
19+
node-version: '20' # Use a current LTS version
20+
cache: 'npm'
21+
22+
- name: Install dependencies
23+
run: npm ci
24+
25+
- name: Build project
26+
run: npm run build
27+
28+
- name: Run VibeSafe Scan (High Only)
29+
# This uses the globally linked bin command setup in package.json
30+
# Or run directly: node dist/index.js scan --high-only
31+
run: npx vibesafe scan --high-only

‎.gitignore

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Node.js
2+
node_modules/
3+
npm-debug.log*
4+
yarn-debug.log*
5+
yarn-error.log*
6+
package-lock.json
7+
yarn.lock
8+
*.env
9+
dist/
10+
build/
11+
12+
# Python
13+
__pycache__/
14+
*.pyc
15+
*.pyo
16+
*.pyd
17+
*.so
18+
.Python
19+
env/
20+
venv/
21+
ENV/
22+
venv.bak/
23+
ENV.bak/
24+
*.egg-info/
25+
*.egg
26+
build/
27+
dist/
28+
*.spec
29+
30+
# OS specific
31+
.DS_Store
32+
Thumbs.db
33+
34+
# IDE specific
35+
.idea/
36+
.vscode/
37+
*.swp
38+
*.swo
39+
40+
# Test Reports
41+
test-*.md
42+
test-*.json

‎LICENSE

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
Copyright (c) 2025 Secret Society LLC - All Rights Reserved
2+
3+
NOTICE: This software, VibeSafe (the "Software"), is provided free of charge for execution and use. The source code is made available for transparency and inspection purposes only.
4+
5+
PERMISSION IS NOT GRANTED to modify, copy, merge, publish, distribute, sublicense, and/or sell copies of the Software, or any substantial portions of it.
6+
7+
PERMISSION IS NOT GRANTED to create derivative works based on the Software or its source code.
8+
9+
PERMISSION IS NOT GRANTED to redistribute the Software or its source code.
10+
11+
Reverse engineering, decompiling, or disassembling the Software is prohibited.
12+
13+
The Software is provided "AS IS", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the Software or the use or other dealings in the Software.
14+
15+
By using or accessing the Software or its source code, you agree to these terms. If you do not agree to these terms, do not use or access the Software or its source code.
16+
17+
For any licensing inquiries beyond the scope of this license, please contact [email protected].

‎README.md

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# VibeSafe ✨🛡️
2+
3+
A CLI tool to scan your codebase for security vibes.
4+
5+
VibeSafe helps developers quickly check their projects for common security issues like exposed secrets, outdated dependencies with known vulnerabilities (CVEs), and generates helpful reports.
6+
7+
## Features (MVP)
8+
9+
* **Secret Scanning:** Detects potential secrets (API keys, credentials) using regex patterns and entropy analysis.
10+
* **Dependency Scanning:** Parses package manifests (currently `package.json`) and checks dependencies against the OSV.dev vulnerability database.
11+
* **Multiple Output Formats:** Provides results via console output (with colors!), JSON (`--output`), or a Markdown report (`--report`).
12+
* **AI-Powered Suggestions (Optional):** Generates fix suggestions in the Markdown report using OpenAI (requires API key).
13+
* **Filtering:** Focus on high-impact issues using `--high-only`.
14+
* **Customizable Ignores:** Use a `.vibesafeignore` file (similar syntax to `.gitignore`) to exclude specific files or directories from the scan.
15+
16+
## Installation
17+
18+
```bash
19+
# Assuming publication to npm eventually
20+
npm install -g vibesafe
21+
```
22+
23+
*(Note: Currently, for local development, use `npm link` after building)*
24+
25+
## Usage
26+
27+
**Basic Scan (Current Directory):**
28+
29+
```bash
30+
vibesafe scan
31+
```
32+
33+
**Scan a Specific Directory:**
34+
35+
```bash
36+
vibesafe scan ./path/to/your/project
37+
```
38+
39+
**Output to JSON:**
40+
41+
```bash
42+
vibesafe scan -o scan-results.json
43+
```
44+
45+
**Generate Markdown Report:**
46+
47+
```bash
48+
vibesafe scan -r scan-report.md
49+
```
50+
51+
**Generate AI Report (Requires API Key):**
52+
53+
To generate fix suggestions in the Markdown report, you need an OpenAI API key.
54+
55+
1. Create a `.env` file in the root of the directory where you run `vibesafe` (or in the project root if running locally during development).
56+
2. Add your key to the `.env` file:
57+
```
58+
OPENAI_API_KEY=sk-YourActualOpenAIKeyHere
59+
```
60+
3. Run the scan with the report flag:
61+
```bash
62+
vibesafe scan -r ai-report.md
63+
```
64+
65+
**Show Only High/Critical Issues:**
66+
67+
```bash
68+
vibesafe scan --high-only
69+
```
70+
71+
## Ignoring Files (.vibesafeignore)
72+
73+
Create a `.vibesafeignore` file in the root of the directory being scanned. Add file paths or glob patterns (one per line) to exclude them from the scan. The syntax is the same as `.gitignore`.
74+
75+
**Example `.vibesafeignore`:**
76+
77+
```
78+
# Ignore all test data
79+
test-data/
80+
81+
# Ignore a specific configuration file
82+
config/legacy-secrets.conf
83+
84+
# Allow scanning a specific .env file if needed (overrides default info behavior)
85+
# !.env.production
86+
```
87+
88+
## License
89+
90+
This project uses a custom proprietary license. Please see the [LICENSE](LICENSE) file for details. TL;DR: Free to use, source visible, but no modification, copying, or redistribution allowed.

‎instructions.md

+142
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
# VibeSafe MVP Development Plan
2+
3+
## 1. Overview
4+
5+
**Problem:** Developers ship code quickly but often miss basic security checks (secrets, stale deps, known CVEs).
6+
**Solution:** A zero‑config CLI that scans a repo for secrets, outdated packages, and CVEs, then generates an AI‑powered risk report.
7+
**MVP Goal:** Enable any developer to run `vibesafe scan` and get a readable security summary—including file paths and line numbers—in under 60 s.
8+
9+
## 2. Personas & Use Cases
10+
11+
| Persona | Scenario | Outcome |
12+
| ------------------ | ------------------------------------------------------------------- | ----------------------------------------- |
13+
| Solo "vibe" coder | Quickly wants to check a side‑project for exposed keys before release | Markdown/JSON report with file, location, and severity‑scored findings |
14+
| CI/CD integrator | Needs build to fail if any HIGH vulnerabilities are present | CI job exits non-zero on HIGH issues |
15+
| Security advocate | Reviews multiple repos for baseline security hygiene | Exports JSON for bulk analysis |
16+
17+
## 3. Scope & Non‑Goals
18+
19+
**In‑Scope (MVP):**
20+
- Secrets & plaintext key detection with file & line
21+
- Dependency parsing + CVE lookup
22+
- AI‑driven markdown risk report with fix suggestions
23+
- CLI UX: colorized terminal + `--output` flags
24+
25+
**Out‑of‑Scope (v0.1+):**
26+
- Automatic patching (`--fix`)
27+
- Remote‑repo scanning
28+
- Real‑time IDE plugins
29+
- Telemetry collection (opt‑in only)
30+
- TODO: Proactively check `.gitignore` for `.env` exclusion patterns
31+
32+
## 4. Success Metrics
33+
34+
1. **Performance:** Full scan < 60 s on a 100 MB repo
35+
2. **Coverage:** Detects ≥ 5 unique issues in standard test repos
36+
3. **Adoption:** ≥ 10 installs in first week (npm/pip downloads)
37+
4. **Reliability:** CI exit code behavior consistent (HIGH → non-zero)
38+
39+
## 5. Phases & Atomic Tasks
40+
41+
### Phase 1: Setup & CI Integration
42+
1. **Repo scaffold**
43+
- [x] `mkdir vibesafe && cd vibesafe`
44+
- [x] Initialize Git + add `.gitignore`, `LICENSE`, `README.md`
45+
- [x] Choose language: TypeScript (commander.js) ~~_or_ Python (argparse)~~
46+
- [x] Add basic `vibesafe scan` command stub
47+
2. **CI hook**
48+
- [x] Write a GitHub Actions workflow that runs `vibesafe scan --high-only`
49+
- [x] Ensure exit code propagates
50+
51+
### Phase 2: Secrets Scanner
52+
1. **Regex & entropy engine**
53+
- [x] Define regex patterns for `.env`, AWS, JWT, SSH keys
54+
- [x] Integrate an entropy checker (e.g., Shannon entropy > threshold)
55+
2. **File traversal**
56+
- [x] Walk directory tree, skip default excludes (`node_modules`, `dist`)
57+
- [x] Honor `.vibesafeignore` entries
58+
3. **Scoring & output**
59+
- [x] Assign Low/Med/High severity based on pattern + entropy
60+
- [x] Emit JSON record per finding including `file`, `line`, `pattern`, and `severity`
61+
62+
### Phase 3: Dependency & CVE Scanner
63+
1. **Detect package manager**
64+
- [x] Inspect files: `package.json`, `yarn.lock`, `requirements.txt`
65+
2. **Parse deps**
66+
- [x] Extract name + version pairs
67+
3. **CVE lookup**
68+
- [x] Call OSV.dev or NVD API with each dep
69+
- [x] Capture CVE IDs, severity, published date
70+
4. **Threshold filtering**
71+
- [x] Mark HIGH if any dep ≥ 7.0 severity
72+
73+
### Phase 4: AI Risk Report
74+
1. **Markdown skeleton**
75+
- [x] Build template:
76+
```md
77+
# VibeSafe Report
78+
79+
## Summary
80+
- Total Issues: 5 (2 High, 2 Medium, 1 Low)
81+
82+
## Details
83+
| File | Location | Issue | Severity | CVE/Pattern |
84+
| ------------------ | ---------- | ---------------- | -------- | ------------- |
85+
| `.env` | line 10 | AWS Key exposed | High | — |
86+
| `config/app.js` | line 45 | JWT secret | Medium | — |
87+
| `package.json` | line 23 | lodash 4.17 | Medium | CVE-2024-123 |
88+
| `requirements.txt` | line 12 | Django 2.2 | High | CVE-2023-456 |
89+
| `src/utils.ts` | line 80 | Hardcoded token | Low | — |
90+
91+
## Fix Suggestions
92+
1. Remove AWS keys from code; use environment variables and a secrets vault.
93+
2. Rotate JWT secret and move to env vars.
94+
3. Upgrade `lodash` to ≥ 4.17.21.
95+
4. Update Django to ≥ 3.2.
96+
5. Replace hardcoded tokens with secure storage.
97+
```
98+
2. **LLM integration**
99+
- [x] Send JSON findings + skeleton to GPT‑4o-mini
100+
- [x] Parse human‑readable summary & per‑issue suggestions
101+
- [x] Merge into final MD
102+
103+
### Phase 5: CLI UX & Packaging
104+
1. **Terminal polish**
105+
- [ ] Colorize severities (e.g., red for High)
106+
- [ ] Add progress spinner during scans
107+
2. **Flags & outputs**
108+
- [ ] `--output <file.md|.json>`
109+
- [ ] `--high-only` filter
110+
3. **Distribution**
111+
- [ ] Set up npm `bin` or Python `entry_point`
112+
- [ ] Test on macOS, Win, Linux
113+
114+
## 6. Timeline & Ownership
115+
116+
| Week | Focus | Owner |
117+
| ------ | ------------------------------ | ------------ |
118+
| Week 1 | Phase 1 scaffold + CI | @you |
119+
| Week 2 | Phase 2 secrets scanner | @security |
120+
| Week 3 | Phase 3 dep & CVE scanner | @sec‑lead |
121+
| Week 4 | Phase 4 AI report & polish | @AI‑engineer |
122+
| Week 5 | Phase 5 packaging & QA | @release |
123+
124+
## 7. Risks & Mitigations
125+
126+
- **API rate limits (OSV/NVD):** cache results locally; implement exponential back‑off
127+
- **False positives (secrets):** tune regex & entropy thresholds; allow exclusions
128+
- **LLM costs:** only call on `--report` mode; support a dry‑run without AI
129+
130+
## 8. In Cursor
131+
132+
- **Check progress:**
133+
> “What is the current status of Phase 2: Secrets Scanner?”
134+
- **Mark tasks done:**
135+
> “Mark Phase 3.3 (CVE lookup) as complete.”
136+
137+
---
138+
139+
**Next Steps:**
140+
1. Review personas & success metrics.
141+
2. Assign owners & adjust timeline as needed.
142+
3. Kick off Week 1!

‎package.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"name": "vibesafe",
3+
"version": "0.0.1",
4+
"description": "A CLI tool to scan your codebase for security vibes.",
5+
"main": "dist/index.js",
6+
"bin": {
7+
"vibesafe": "dist/index.js"
8+
},
9+
"scripts": {
10+
"build": "tsc",
11+
"start": "node dist/index.js",
12+
"dev": "ts-node src/index.ts",
13+
"test": "echo \"Error: no test specified\" && exit 1"
14+
},
15+
"keywords": [
16+
"security",
17+
"scanner",
18+
"cli"
19+
],
20+
"author": "",
21+
"license": "SEE LICENSE IN LICENSE",
22+
"devDependencies": {
23+
"@types/node": "^22.14.1",
24+
"ts-node": "^10.9.2",
25+
"typescript": "^5.8.3"
26+
},
27+
"dependencies": {
28+
"axios": "^1.8.4",
29+
"chalk": "^4.1.2",
30+
"commander": "^13.1.0",
31+
"dotenv": "^16.5.0",
32+
"ignore": "^7.0.3",
33+
"openai": "^4.95.0",
34+
"ora": "^5.4.1"
35+
}
36+
}

0 commit comments

Comments
 (0)