I kept seeing the same security vulnerabilities
appearing across multiple production codebases
built with AI coding tools. SQL injection via
f-strings. Hardcoded credentials. JWT tokens
without algorithm verification. Different
companies. Different teams. Different projects.
Same mistakes every time.
The common thread was always an AI coding tool.
Copilot, Cursor, ChatGPT — all producing the
same anti-patterns because they all learned from
the same internet code that had those vulnerabilities
baked into it.
Existing tools like Bandit and Semgrep use generic
rules that were not built around AI tool failure
modes. They miss the subtle patterns that matter
most in AI-generated code.
VibeGuard fills that gap — 19 rules built from
studying actual AI-generated code across real
production codebases. Every rule identifies which
AI tool most commonly produces the pattern and
every finding includes the exact working code
to fix it.
Validated it this week by scanning a real
production TypeScript codebase — 533 files,
3 critical vulnerabilities found in actual
source code, all missed by their existing
security pipeline.
Three things I am most interested in feedback on:
1. Are there AI code patterns you have seen
repeatedly that are not covered here?
2. The grading system A to F — useful signal
or too simplistic?
3. Currently Python, JS and TS — which language
should I prioritise next?
Author here. Happy to answer any questions.
Background on why I built this:
I kept seeing the same security vulnerabilities appearing across multiple production codebases built with AI coding tools. SQL injection via f-strings. Hardcoded credentials. JWT tokens without algorithm verification. Different companies. Different teams. Different projects. Same mistakes every time.
The common thread was always an AI coding tool. Copilot, Cursor, ChatGPT — all producing the same anti-patterns because they all learned from the same internet code that had those vulnerabilities baked into it.
Existing tools like Bandit and Semgrep use generic rules that were not built around AI tool failure modes. They miss the subtle patterns that matter most in AI-generated code.
VibeGuard fills that gap — 19 rules built from studying actual AI-generated code across real production codebases. Every rule identifies which AI tool most commonly produces the pattern and every finding includes the exact working code to fix it.
Validated it this week by scanning a real production TypeScript codebase — 533 files, 3 critical vulnerabilities found in actual source code, all missed by their existing security pipeline.
Three things I am most interested in feedback on:
1. Are there AI code patterns you have seen repeatedly that are not covered here?
2. The grading system A to F — useful signal or too simplistic?
3. Currently Python, JS and TS — which language should I prioritise next?
github.com/zeroFhacker/vibeguard