Metadata-Version: 2.4
Name: vibesafe-scanner
Version: 0.1.1
Summary: Security scanner for vibe-coded applications
Author-email: VibeSafe <hello@vibesafe.ai>
License: MIT
Project-URL: Homepage, https://github.com/CodAngels/vibesafe
Project-URL: Issues, https://github.com/CodAngels/vibesafe/issues
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# VibeSafe Scanner

A lightweight security scanner for vibe-coded applications.

## Installation

```bash
pip install vibesafe-scanner
```

Or install from source:

```bash
pip install -e .
```

## Usage

Scan the current directory:

```bash
vibesafe scan
```

Scan a specific directory:

```bash
vibesafe scan --path /path/to/project
```

Output as JSON:

```bash
vibesafe scan --json
```

## What It Checks

### Secrets
- .env files committed to git
- Hardcoded API keys (OpenAI, AWS, Google, GitHub, Slack)

### AI Spend Risks
- AI calls inside loops
- Missing max_tokens limits
- Retry loops around AI calls

### Authentication
- Debug authentication bypasses
- Plaintext password storage

### Infrastructure
- Debug mode enabled
- CORS wildcard configuration
- Potential SQL injection risks

## Exit Codes

- `0` - Scan passed, no failures
- `1` - Scan found failures or error occurred

## Features

- 🚀 Fast (<5 seconds for most repos)
- 🎯 High-signal, low-noise checks
- 📍 Evidence-based findings with file:line references
- 🎨 Clear visual output with status icons
- 💡 Explains why each issue is dangerous
- 📊 Security score (0-100)

## License

MIT
