Background on why I built this:
I kept seeing the same security vulnerabilities appearing across multiple production codebases built with AI coding tools. SQL injection via f-strings. Hardcoded credentials. JWT tokens without algorithm verification. Different companies. Different teams. Different projects. Same mistakes every time.
The common thread was always an AI coding tool. Copilot, Cursor, ChatGPT — all producing the same anti-patterns because they all learned from the same internet code that had those vulnerabilities baked into it.
Existing tools like Bandit and Semgrep use generic rules that were not built around AI tool failure modes. They miss the subtle patterns that matter most in AI-generated code.
VibeGuard fills that gap — 19 rules built from studying actual AI-generated code across real production codebases. Every rule identifies which AI tool most commonly produces the pattern and every finding includes the exact working code to fix it.
Validated it this week by scanning a real production TypeScript codebase — 533 files, 3 critical vulnerabilities found in actual source code, all missed by their existing security pipeline.
Three things I am most interested in feedback on:
1. Are there AI code patterns you have seen repeatedly that are not covered here?
2. The grading system A to F — useful signal or too simplistic?
3. Currently Python, JS and TS — which language should I prioritise next?
github.com/zeroFhacker/vibeguard