VibeGuard Rule Reference

This page is generated from the rule metadata registry (vibeguard/rules/registry.py). Every rule documented below ships in the vibeguard package; third-party rules contributed via the plugin API appear at runtime in vibeguard rules list.

Summary

Rule	Title	Config section	Default severity	Confidence	Findings	Tags	Applies to
agent_memory	Agent Memory Artifacts	agent_memory	high	medium	5	security, agent-memory, data-leak	*.sqlite, *.sqlite3, *.db, *.jsonl, *.ndjson
ai_footprints	AI Footprint Detection	ai_footprints	medium	medium	8	ai-footprint, security	*.py, *.js, *.ts, *.go, *.yaml
auth	Auth/Authz Bypass Detection	auth	high	medium	8	security, auth	*.py, *.js, *.ts, *.go, *.rb, *.java, *.cs
ci_docker	Docker/CI Security	ci_docker	high	high	11	security, docker, ci, github-actions	Dockerfile, Dockerfile.*, .dockerfile, .github/workflows/.yml
dependencies	Dependency Risk	dependencies	high	medium	9	security, supply-chain, dependencies	package.json, pyproject.toml, .npmrc, pip.conf
error_handling	Swallowed Errors	error_handling	medium	medium	3	reliability, ai, error-handling	*.py, *.js, *.ts, *.go
go_rules	Go Risky Patterns	go_rules	high	medium	7	security, go	*.go
iac	Infrastructure-as-Code Security	iac	high	high	10	security, iac, terraform, kubernetes	*.tf, *.yaml, *.yml
lint_suppressions	Blanket Lint Suppressions	lint_suppressions	medium	medium	6	developer-experience, testing, ai, lint-suppressions	*.cjs, *.go, *.js, *.jsx, *.mjs, *.py, *.pyi, *.ts, *.tsx
packaging	Packaging Hygiene	packaging	medium	high	14	packaging, supply-chain	package.json, pyproject.toml, MANIFEST.in, setup.cfg, .npmignore
prompt_injection	Prompt Injection in Code	prompt_injection	high	medium	4	security, ai-security, prompt-injection	*.py, *.js, *.ts, *.md, *.yaml, *.json, *.txt
risky_diff	Risky Code Pattern	risky_patterns	medium	medium	20	security, risky-diff	*.py, *.js, *.ts, *.go, *.java, *.rb
secrets	Secrets Detection	secrets	high	high	12	security, secrets	*
slopsquat	Slopsquatting / Hallucinated Dependency	slopsquat	high	low	3	security, supply-chain, dependencies, slopsquatting	package.json, pyproject.toml, requirements*.txt
sourcemaps	Source Map Exposure	sourcemaps	high	high	4	security, sourcemaps, packaging	*.map, *.js, package.json
sql	SQL Construction Risk	sql	high	medium	6	security, sql, injection	*.py, *.js, *.ts, *.go
test_integrity	Test Integrity	test_integrity	medium	high	4	testing, ai, test-integrity	*.py, *.js, *.ts, pyproject.toml, .coveragerc, package.json
tests	Missing Tests	tests	low	medium	1	tests, coverage	*.py, *.js, *.ts

Rules

agent_memory — Agent Memory Artifacts

Detects accidentally committed agent memory artifacts: SQLite databases, JSONL logs, transcripts, tool traces, and hidden memory directories.

• Default severity: high
• Confidence: medium
• Config section: agent_memory (in vibeguard.yaml)
• Tags: security, agent-memory, data-leak
• Applies to: *.sqlite, *.sqlite3, *.db, *.jsonl, *.ndjson

Finding IDs

• AGENT-MEMORY-DB — Remove the agent memory database from git and add the pattern (*.sqlite, memory.db, etc.) to .gitignore. Audit the file for accidentally captured secrets or PII.
• AGENT-MEMORY-LOG — Remove the JSONL/NDJSON log from git and ignore the path. Agent logs frequently contain prompts, secrets, and private data.
• AGENT-TRANSCRIPT — Delete the committed conversation transcript and add it to .gitignore. Treat any credentials, tokens, or customer data inside it as leaked.
• AGENT-TOOL-TRACE — Tool-call traces routinely contain arguments and tokens. Remove the trace file from git history and add the path to .gitignore.
• AGENT-MEMORY-DIR — Remove the hidden memory directory (.claude/, .agent_memory/, etc.) from the repo and ignore it. Treat anything previously committed there as leaked.

ai_footprints — AI Footprint Detection

Detects AI-generated artifacts, placeholders, security bypasses, trust-all certificates, CORS wildcards, and hallucinated TODOs.

• Default severity: medium
• Confidence: medium
• Config section: ai_footprints (in vibeguard.yaml)
• Tags: ai-footprint, security
• Applies to: *.py, *.js, *.ts, *.go, *.yaml

Finding IDs

• AI-AIGENERATED — Remove the AI-generation marker before merging. Read the surrounding code carefully — generated code without human review tends to hide subtle bugs.
• AI-PLACEHOLDERCRED — Replace the placeholder credential with a real one loaded from a secret manager or environment variable. Leaving changeme/password123 in code blocks integration.
• AI-DISABLESECURITY — Re-enable the security control. If the bypass is required for a narrow case, document why, gate it behind a flag, and request a security-aware review.
• AI-TRUSTALLCERTS — Restore certificate verification. Use a proper CA bundle or pin the specific certificate the environment requires — never trust everything.
• AI-CORSWILDCARD — Replace * origins with the specific hosts your frontend uses. Wildcard CORS combined with credentials is a well-known account-takeover vector.
• AI-TEMPBYPASS — Remove the temporary bypass before merging. If it cannot be removed yet, track it as a ticket and add a test that fails when the bypass remains in place.
• AI-SKIPVALIDATION — Restore the validation step. Skipping validation in tests or middleware often leaks into production via copy-paste.
• AI-HALLUCINATEDTODO — Resolve the TODO or remove it. AI assistants often emit TODO: implement real X when they couldn't complete a step — leaving it in is a future incident.

auth — Auth/Authz Bypass Detection

Detects patterns indicating authentication or authorization bypasses: commented-out auth, JWT none algorithm, hardcoded admin passwords, disabled verification, auth functions returning nil/True.

• Default severity: high
• Confidence: medium
• Config section: auth (in vibeguard.yaml)
• Tags: security, auth
• Applies to: *.py, *.js, *.ts, *.go, *.rb, *.java, *.cs

Finding IDs

• AUTH-BYPASS-COMMENT — Remove the bypass and re-enable the auth check. If the bypass is intentional for a debug path, gate it behind an explicit feature flag and add a test that fails when it is left enabled in production.
• AUTH-DISABLED-MIDDLEWARE — Re-register the authentication middleware. If a specific route legitimately needs to be public, mark it on the route itself instead of removing global middleware.
• AUTH-VERIFY-FALSE — Restore certificate / signature verification. If a local cert is needed for development, load it from a real CA bundle rather than disabling verification.
• AUTH-ALLOW-ALL — Replace the allow-all rule with an explicit allow-list. Default deny, then grant the minimum required access.
• AUTH-JWT-NONE — Reject the none algorithm. Pin the verifier to a specific allow-list of algorithms (typically RS256 or EdDSA) and validate kid/issuer.
• AUTH-HARDCODED-ADMIN — Remove the hardcoded admin credential. Use a real account with a unique password and rotate the value immediately.
• AUTH-RETURN-NIL-AUTH — Auth functions must signal failure explicitly. Replace the return nil/return True shortcut with the real auth check and add a test that exercises the unauthenticated path.
• AUTH-COMMENTED-AUTH — Uncomment or re-add the auth check before merging. If the code is dead, delete it; commented-out auth is a classic AI-generated regression.

ci_docker — Docker/CI Security

Detects risky patterns in Dockerfiles and GitHub Actions workflows: privileged containers, secret leaks, unversioned actions, curl-pipe-bash.

• Default severity: high
• Confidence: high
• Config section: ci_docker (in vibeguard.yaml)
• Tags: security, docker, ci, github-actions
• Applies to: Dockerfile, Dockerfile.*, *.dockerfile, .github/workflows/*.yml

Finding IDs

• DOCKER-PRIVILEGED — Drop --privileged/privileged: true. Use explicit capabilities (--cap-add) or, better, find a path that doesn't need any kernel privileges.
• DOCKER-LATEST-TAG — Pin the base image to a specific digest or version tag. :latest makes builds non-reproducible and hides supply-chain rebases.
• DOCKER-CURL-BASH — Avoid curl … \| bash. Download the installer, verify a checksum or signature, then execute. Better yet, install via a versioned package.
• DOCKER-BROAD-CHMOD — Replace chmod 777/chmod -R 777 with the narrowest mode your process needs. World-writable bits are rarely correct.
• DOCKER-SECRET-ENV — Don't bake secrets into the image. Pass them as build secrets (--secret) or read them from the orchestrator at runtime.
• DOCKER-ADD-URL — Use COPY against a verified local artifact, or RUN curl with a checksum check. ADD <URL> skips integrity checks and follows redirects silently.
• GHA-PULL-REQUEST-TARGET — Switch the workflow to pull_request and restrict secret access. pull_request_target runs with write tokens on untrusted forks — confirm you actually need it.
• GHA-BROAD-PERMISSIONS — Replace permissions: write-all with explicit minimum scopes per job (e.g. contents: read, pull-requests: write).
• GHA-SECRET-ECHO — Remove the echo/run step that exposes a secret. Even behind a mask, secrets in shell commands can leak via process listings or downstream logs.
• GHA-DISABLE-CHECK — Restore the disabled check. If a check is genuinely obsolete, delete the workflow rather than leaving a disabled stub that confuses reviewers.
• GHA-UNVERSIONED-ACTION — Pin third-party actions to a commit SHA (e.g. uses: actions/checkout@<sha>). Floating refs like @main/@v1 can be force-pushed.

dependencies — Dependency Risk

Detects risky dependency changes: typosquatting, git/URL deps, broad versions, lockfile drift, and registry changes.

• Default severity: high
• Confidence: medium
• Config section: dependencies (in vibeguard.yaml)
• Tags: security, supply-chain, dependencies
• Applies to: package.json, pyproject.toml, .npmrc, pip.conf

Finding IDs

• DEP-URLNODE — Publish the dependency to a registry and use a versioned specifier (name@^1.2.3). Direct git/URL deps bypass lockfiles and integrity checks.
• DEP-BROADVER — Tighten the version range. Avoid */x/latest and prefer a ^1.2 or pinned 1.2.3 constraint.
• DEP-TYPOSQUATNPM — Verify this is the package you intended. Check npmjs.com ownership and weekly downloads before installing. Replace with the canonical package if this was a typo.
• DEP-URLPYTHON — Publish the dependency to PyPI and use a versioned specifier. URL/git installs have no integrity hash and skip wheel signing.
• DEP-UNPINNEDPY — Add a version constraint (e.g. name>=1.0,<2.0). Unpinned deps make builds non-reproducible.
• DEP-TYPOSQUATPY — Confirm the package name on pypi.org. Replace with the canonical package if this was a typo (requests not requesst, etc.).
• DEP-LOCKFILE-MISMATCH — Regenerate the lockfile so it matches the manifest (npm install/poetry lock). Drift between the two is how supply-chain attacks slip into CI.
• DEP-MANIFEST-NO-LOCK — Commit a lockfile alongside the manifest. Without one, every install resolves transitives non-deterministically.
• DEP-REGISTRY-CHANGE — Confirm the new registry/index URL is intentional and trusted. Document the change in the PR description and monitor build integrity logs after merge.

error_handling — Swallowed Errors

Flags newly introduced error-swallowing (bare except: pass, empty catch blocks, discarded Go errors).

• Default severity: medium
• Confidence: medium
• Config section: error_handling (in vibeguard.yaml)
• Tags: reliability, ai, error-handling
• Applies to: *.py, *.js, *.ts, *.go

Finding IDs

• ERR-BARE-EXCEPT-PASS — Handle the error (log it with context, retry, or re-raise) or narrow the except to the specific exception you expect. If suppression is genuinely intended, use contextlib.suppress(SpecificError) so the intent is explicit.
• ERR-EMPTY-CATCH — Do something with the caught error: log it with context, surface it to the caller, or rethrow. An empty (or log-only) catch hides failures.
• ERR-DISCARDED-GO — Check and handle the returned error rather than discarding it. Return it, wrap it with context (fmt.Errorf("...: %w", err)), or log it — do not drop it with _ = err or an empty if err != nil {} body.

go_rules — Go Risky Patterns

Detects Go-specific security risks including TLS bypass, shell injection, CORS wildcards, SQL via Sprintf, hardcoded tokens, auth bypass comments, and unsafe file deletion.

• Default severity: high
• Confidence: medium
• Config section: go_rules (in vibeguard.yaml)
• Tags: security, go
• Applies to: *.go

Finding IDs

• GO-INSECURE-TLS — Remove InsecureSkipVerify: true from the tls.Config. Use the system CA bundle, or pin a known root via x509.CertPool.
• GO-EXEC-SHELL — Use exec.Command(name, args...) with arguments as separate strings. Avoid sh -c and never interpolate user input into the command string.
• GO-CORS-WILDCARD — Set Access-Control-Allow-Origin to an explicit allow-list, not *. Wildcard + credentials is a known account-takeover vector.
• GO-SQL-SPRINTF — Replace fmt.Sprintf SQL with db.QueryContext/db.ExecContext and ? placeholders so the driver handles escaping.
• GO-HARDCODED-TOKEN — Move the token to an environment variable or secret manager. Rotate it immediately and audit any downstream system that may have logged the value.
• GO-AUTH-BYPASS — Re-enable the authentication middleware/check. If a public route is intentional, mark it on the route itself rather than removing global guards.
• GO-UNSAFE-DELETE — Guard os.RemoveAll/os.Remove with explicit path validation. Confirm the path stays within an expected root before deleting.

iac — Infrastructure-as-Code Security

Detects risky patterns in Terraform (IAM wildcards, open security groups, public S3) and Kubernetes (privileged containers, hostPath, root user).

• Default severity: high
• Confidence: high
• Config section: iac (in vibeguard.yaml)
• Tags: security, iac, terraform, kubernetes
• Applies to: *.tf, *.yaml, *.yml

Finding IDs

• TF-IAM-WILDCARD — Replace * actions/resources in IAM policy with the specific calls and ARNs required. Least-privilege is the single biggest IAM hardening you can do.
• TF-SG-OPEN — Lock the security group's CIDR from 0.0.0.0/0 to the specific addresses or VPC ranges that need access.
• TF-S3-PUBLIC — Set the bucket to private (acl = "private", block_public_acls = true). Use signed URLs or CloudFront for legitimate public access.
• TF-UNENCRYPTED — Enable encryption at rest (server_side_encryption_*, encrypted = true). Use a managed KMS key unless you have a compliance reason to bring your own.
• TF-NO-VERSION-PIN — Pin providers and modules with a version constraint (~> 5.0 or exact). Floating providers can ship breaking changes mid-deploy.
• K8S-PRIVILEGED — Set securityContext.privileged: false and only add the specific capabilities the workload needs.
• K8S-HOST-PATH — Avoid hostPath volumes. Use a dedicated PVC or an emptyDir if the data is ephemeral; hostPath escapes the container boundary.
• K8S-NO-TLS — Configure TLS for the ingress/service. Cluster-internal plaintext is a regression even on private networks.
• K8S-ALLOW-ALL — Replace allow-all NetworkPolicy/RBAC with explicit ingress/egress rules and minimum RBAC verbs.
• K8S-ROOT-CONTAINER — Set runAsNonRoot: true and pick a numeric UID. Running as root inside the container is unnecessary for almost every workload.

lint_suppressions — Blanket Lint Suppressions

Flags newly introduced blanket linter/type-checker suppressions (bare # noqa, # type: ignore, eslint-disable, @ts-nocheck, #nosec, //nolint). Scoped suppressions with codes are not flagged.

• Default severity: medium
• Confidence: medium
• Config section: lint_suppressions (in vibeguard.yaml)
• Tags: developer-experience, testing, ai, lint-suppressions
• Applies to: *.cjs, *.go, *.js, *.jsx, *.mjs, *.py, *.pyi, *.ts, *.tsx

Finding IDs

• SUPPRESS-BARE-NOQA — Scope the suppression to the specific rule(s): # noqa: E501. A bare # noqa hides every current and future lint error on the line.
• SUPPRESS-TYPE-IGNORE — Add the specific error code: # type: ignore[arg-type]. A bare # type: ignore silences all type errors on the line, including future regressions.
• SUPPRESS-ESLINT-FILE — Replace the file-wide /* eslint-disable */ with a scoped disable for the specific rule(s), or fix the underlying issues.
• SUPPRESS-TS-NOCHECK — Prefer @ts-expect-error (which fails when the error is fixed) over @ts-ignore/@ts-nocheck, and scope it to the single line that needs it.
• SUPPRESS-NOSEC-BARE — Add the Bandit test ID so the suppression is auditable: # nosec B101. A bare #nosec disables every Bandit check on the line.
• SUPPRESS-NOLINT-BARE — List the linter(s) the suppression applies to: //nolint:errcheck. A bare //nolint disables all linters on the line.

packaging — Packaging Hygiene

Detects files that should not be published in npm/PyPI packages: secrets, test data, build configs, source maps.

• Default severity: medium
• Confidence: high
• Config section: packaging (in vibeguard.yaml)
• Tags: packaging, supply-chain
• Applies to: package.json, pyproject.toml, MANIFEST.in, setup.cfg, .npmignore

Finding IDs

• PKG-NPMFILES — Trim the files array in package.json to only the runtime artifacts. Move tests, fixtures, and dev configs outside the published tree.
• PKG-NPMBROAD — Replace broad files patterns (./, *, **) with a curated allow-list. The default whole-directory publish leaks tests, .env, and tooling configs.
• PKG-NPMLEAK — Remove the leaking entry (.env, secrets, fixtures) from the npm files list. Rotate any credential that may have been packaged in a prior release.
• PKG-PYBROAD — Replace include = ['*'] or packages = find_packages() with an explicit list of importable modules so internal tooling is excluded from the wheel.
• PKG-PYLEAK — Remove the sensitive file from the sdist/wheel by tightening MANIFEST.in, tool.hatch.build.include, or your build backend's package list. Rotate any leaked credential.
• PKG-MANIFESTLEAK — Edit MANIFEST.in to remove the entry that pulls in sensitive files. Run python -m build and inspect the sdist to confirm the file is gone.
• PKG-MANIFEST-GRAFT — Replace graft with a narrow include directive scoped to the specific files you need. graft recursively pulls in every file under a tree and is prone to leaks.
• PKG-MANIFEST-RECURSIVE — Replace recursive globs (e.g. recursive-include * *) with explicit, scoped include rules so you can see what ships.
• PKG-NPMIGNORE-NEGATE — Avoid !-prefixed re-includes in .npmignore. They are easy to misread and tend to re-add the very files you intended to exclude.
• PKG-NPMIGNORE-BROAD — Tighten the .npmignore rule. Broad patterns like * without matching re-includes can silently include or exclude entire directories.
• PKG-COVERAGE-LEAK — Add coverage artefacts (.coverage, coverage.xml, htmlcov/) to .npmignore/MANIFEST.in exclusions so they never ship to a registry.
• PKG-CI-LEAK — Exclude .github/, .gitlab-ci.yml, and similar CI configuration from the published package. They reveal your internal pipeline and can leak secret-injection hints.
• PKG-PREPARE-SCRIPT — Review the prepare/postinstall script for side effects. Lifecycle scripts run automatically on every install and are a common supply-chain attack vector.
• PKG-SETUPPYLEAK — Remove the leaking entry from setup.py/setup.cfg. Inspect the built sdist (tar tf dist/*.tar.gz) to confirm only the intended files ship.

prompt_injection — Prompt Injection in Code

Detects agent-directed prompt-injection instructions planted in comments, docstrings, markdown, config, and data files — including instruction overrides, exfiltration directives, hidden/zero-width Unicode, and base64-obfuscated payloads.

• Default severity: high
• Confidence: medium
• Config section: prompt_injection (in vibeguard.yaml)
• Tags: security, ai-security, prompt-injection
• Applies to: *.py, *.js, *.ts, *.md, *.yaml, *.json, *.txt

Finding IDs

• PI-OVERRIDE — Remove the instruction. Text that tells an AI agent to ignore its rules has no legitimate place in source files — treat it as hostile input planted for a downstream agent to obey.
• PI-EXFIL — Remove the directive. Instructions telling an agent to send secrets, credentials, or environment variables somewhere are an exfiltration attempt; audit who added the file.
• PI-HIDDEN-UNICODE — Strip the invisible/zero-width characters. They are used to smuggle instructions past human review while remaining machine-readable. Re-add any legitimately-needed Unicode visibly.
• PI-OBFUSCATED — Decode and review the blob. Base64 next to agent-directed text is a common way to hide injected instructions from a human reviewer.

risky_diff — Risky Code Pattern

Flags changes to risk-sensitive areas (auth, crypto, shell, network, etc.) and diff-scope signals (breadth, size, risk files) for human review.

• Default severity: medium
• Confidence: medium
• Config section: risky_patterns (in vibeguard.yaml)
• Tags: security, risky-diff
• Applies to: *.py, *.js, *.ts, *.go, *.java, *.rb

Finding IDs

• RISK-AUTHBYPASS — Verify the auth check is intentional and tested. Audit every code path that bypasses authentication before merging.
• RISK-AUTHZCHECK — Confirm the authorization check still enforces the expected policy. Add a test that asserts a non-permitted role is denied.
• RISK-CRYPTOUSAGE — Use vetted primitives from the standard library (e.g. hashlib, secrets, cryptography). Avoid rolling your own crypto and review changes with a security-aware reviewer.
• RISK-EVALEXEC — Eliminate eval/exec if possible. If unavoidable, validate and whitelist inputs strictly before execution and document why the dynamic execution is required.
• RISK-SUBPROCESSSHELL — Pass arguments as a list, never as a single shell string. Avoid shell=True. Validate any user input before it reaches the subprocess.
• RISK-FILEDELETE — Confirm the deletion path is intentional and scoped to expected directories. Add a dry-run option or guardrails to prevent accidental data loss.
• RISK-NETWORKCALL — Ensure the network call respects timeouts, TLS verification, and retry policies. Document any new outbound destinations.
• RISK-DBWRITE — Add tests for the new database write. Confirm transactional boundaries, error handling, and rollback semantics are correct.
• RISK-PAYMENTLOGIC — Payment logic changes need a dedicated review with the finance/billing owner. Add tests that cover currency rounding, refund paths, and idempotency keys.
• RISK-ENVACCESS — Confirm the environment variable is documented in deployment configs and has a safe default. Avoid reading secrets directly from os.environ in request paths.
• RISK-CORSCONFIG — Avoid wildcard origins (*) in CORS configuration. Allow only the specific origins your frontend needs and reject the rest.
• RISK-DESERIALIZATION — Replace pickle/yaml.load/marshal with a safe serialiser (JSON, yaml.safe_load, msgpack). Untrusted deserialisation is a common RCE vector.
• RISK-JWTHANDLING — Validate alg, iss, aud, and exp claims. Never accept the none algorithm. Pin the verification key to a known set of issuers.
• RISK-TRUSTCERTS — Re-enable TLS certificate verification. Use a proper CA bundle (e.g. certifi) or pin the specific CA your environment trusts.
• RISK-PERMCHANGE — File-permission changes should be narrow and explicit. Avoid world-writable bits (0o777) and document any setuid usage.
• RISK-DEBUGMODE — Never ship debug mode to production. Drive the flag from an environment variable that defaults to off (e.g. DEBUG = os.environ.get("DEBUG") == "1") and confirm the production configuration disables it.
• RISK-ALLOWEDHOSTSWILDCARD — Replace the wildcard ALLOWED_HOSTS = ['*'] with the explicit list of hostnames your app serves. A wildcard disables Django's Host-header validation.
• DIFF-BREADTH — Split the change into smaller, reviewable PRs. Wide-breadth diffs hide regressions and slow down review.
• DIFF-SIZE — Large diffs are hard to review carefully. Break the change into incremental PRs each with their own tests.
• DIFF-RISK-FILES — This diff touches security-sensitive files. Request a security-aware reviewer and add tests covering the changed code paths.

secrets — Secrets Detection

Detects likely committed secrets using regex patterns and entropy heuristics. Includes AWS keys, GitHub tokens, OpenAI keys, private keys, and more.

• Default severity: high
• Confidence: high
• Config section: secrets (in vibeguard.yaml)
• Tags: security, secrets
• Applies to: *

Finding IDs

• SEC-AWSACCESSKEY — Rotate the AWS access key immediately in IAM. Remove it from git history and audit CloudTrail for unauthorised use. Prefer IAM roles or AWS Secrets Manager over inline keys.
• SEC-AWSSECRETKEY — Treat as compromised: rotate the AWS secret key and the paired access key id immediately. Audit usage via CloudTrail and remove the value from git history.
• SEC-GITHUBTOKEN — Revoke the token in https://github.com/settings/tokens and issue a fresh one. Remove the value from git history. Store the new token in GitHub Actions secrets or a secret manager.
• SEC-OPENAIKEY — Revoke the key in the OpenAI dashboard, issue a fresh one, and load it from an environment variable. Audit usage logs for unexpected spend.
• SEC-PRIVATEKEY — Re-key any service that trusted this private key. Remove the file from git history and store the new key in a dedicated secret manager (Vault, AWS Secrets Manager, etc.).
• SEC-BEARERTOKEN — Treat the bearer token as leaked. Revoke and re-issue it via the upstream provider, then load the replacement from a secret manager or env var.
• SEC-HARDCODEDPASSWORD — Replace the hardcoded password with an environment variable or secret manager lookup. Rotate the credential and audit any downstream system that may have logged it.
• SEC-DATABASEURL — Move the connection string into an environment variable or secret manager. Rotate the database password and review audit logs for unexpected access.
• SEC-SLACKTOKEN — Revoke the Slack token in the workspace admin console and issue a fresh one with the minimum required scopes. Audit channel access for the leaked token's lifetime.
• SEC-STRIPEKEY — Roll the Stripe API key in the dashboard immediately and audit charges/events for the exposure window. Restricted keys with narrow scopes are safer than full secret keys.
• SEC-GENERICAPIKEY — Treat the value as leaked and rotate it with the upstream provider. Replace the inline literal with an environment variable or secret manager call.
• SEC-ENV — Add .env to .gitignore, remove it from git history, and rotate every credential it contained. Distribute secrets through CI variables or a dedicated secret manager.

slopsquat — Slopsquatting / Hallucinated Dependency

Flags likely AI-hallucinated dependencies. Offline by default: descriptive multi-token names added without a lockfile entry. With the opt-in registry_check, also verifies each dependency exists on the registry and is not suspiciously new.

• Default severity: high
• Confidence: low
• Config section: slopsquat (in vibeguard.yaml)
• Tags: security, supply-chain, dependencies, slopsquatting
• Applies to: package.json, pyproject.toml, requirements*.txt

Finding IDs

• SLOP-HALLUCINATION-SHAPE — Confirm the package is real and intended before installing it. AI assistants invent plausible-looking package names; attackers register those names so the next install pulls malicious code. Check the registry listing, ownership, and download counts, and make sure the dependency appears in your committed lockfile.
• SLOP-REGISTRY-MISSING — The package does not exist on the registry — the AI tool almost certainly hallucinated the name. Remove it or replace it with the real package. Do not run the install until the name is corrected, or a slopsquatter may register it first.
• SLOP-REGISTRY-YOUNG — The package exists but was published very recently. Brand-new packages matching a hallucinated name are a classic slopsquat. Verify the maintainer and provenance before depending on it.

sourcemaps — Source Map Exposure

Detects source maps that may expose original source code in published packages.

• Default severity: high
• Confidence: high
• Config section: sourcemaps (in vibeguard.yaml)
• Tags: security, sourcemaps, packaging
• Applies to: *.map, *.js, package.json

Finding IDs

• MAP-DIST — Add *.map to .npmignore (or remove the matching pattern from files in package.json) so source maps are not shipped to the registry.
• MAP-FILE — Disable source-map output for production bundles, or set the build tool to emit hidden source maps that stay outside the published artifact.
• MAP-URL — Strip the //# sourceMappingURL= comment from the published bundle, or point it at an internal-only host that does not serve the maps publicly.
• MAP-PKG — Remove *.map entries from the files array in package.json (or add *.map to .npmignore) so source maps are excluded from the next publish.

sql — SQL Construction Risk

Detects risk-sensitive SQL construction patterns (f-strings, concatenation, template literals, fmt.Sprintf) that may indicate injection risks.

• Default severity: high
• Confidence: medium
• Config section: sql (in vibeguard.yaml)
• Tags: security, sql, injection
• Applies to: *.py, *.js, *.ts, *.go

Finding IDs

• SQL-PY-FSTRING — Use parameterised queries: pass user values as positional or named bind parameters (e.g. cursor.execute(sql, (a,))). F-strings in SQL invite injection.
• SQL-PY-CONCAT — Replace string concatenation with parameterised queries. Use your driver's ?/%s/named-param syntax instead of + or % on user input.
• SQL-PY-FORMAT — Avoid .format(...) on SQL strings. Build the query with bind parameters so the driver escapes values.
• SQL-JS-TEMPLATE — Use the database client's parameter binding API (?, $1, or prepared statements). Template literals concatenate user input directly into SQL.
• SQL-JS-CONCAT — Replace string concatenation with parameterised queries via the driver. Even +-joined SQL with sanitisation drifts out of sync over time.
• SQL-GO-SPRINTF — Use db.QueryContext / db.ExecContext with ? placeholders. fmt.Sprintf to assemble SQL is the canonical Go injection pattern.

test_integrity — Test Integrity

Flags changes that weaken the test suite: added skip/only markers, deleted tests, and lowered coverage thresholds.

• Default severity: medium
• Confidence: high
• Config section: test_integrity (in vibeguard.yaml)
• Tags: testing, ai, test-integrity
• Applies to: *.py, *.js, *.ts, pyproject.toml, .coveragerc, package.json

Finding IDs

• TEST-SKIP-ADDED — Re-enable the test or fix the underlying failure. A skip added to get CI green hides a regression; if the skip is genuinely needed, document why and link a tracking issue.
• TEST-ONLY-ADDED — Remove the focused-test marker (.only/fit/fdescribe). It silently disables every other test in the file, so CI stops guarding the rest of the suite.
• TEST-DELETED — Confirm the deleted tests are obsolete rather than removed to make a failing pipeline pass. Ensure the behaviour they covered is gone or still tested elsewhere.
• TEST-COVERAGE-LOWERED — Restore the previous coverage threshold. If the reduction is deliberate, justify it in the PR description and track regaining the lost coverage.

tests — Missing Tests

Flags source file changes that lack corresponding test file changes.

• Default severity: low
• Confidence: medium
• Config section: tests (in vibeguard.yaml)
• Tags: tests, coverage
• Applies to: *.py, *.js, *.ts

Finding IDs

• TEST-MISSING — Add unit tests covering the changed logic before merging. Even a happy-path test catches a large share of regressions in AI-generated code.