VibeGuard

//What a finding looks like

• 1. Before

     function deepMerge(target, source) {
       for (const key in source) {
         if (source[key] && typeof source[key] === "object") {
           target[key] = deepMerge(target[key] || {}, source[key]);
         } else {
           target[key] = source[key];
         }
       }
       return target;
     }
     
     function applyOverride(obj, patch) {
       obj.__proto__.polluted = patch;
       return obj;
     }
     
     module.exports = { deepMerge, applyOverride };

  2. VibeGuard says

     HIGHPrototype-polluting merge[VG-INJ-020](confidence: medium)

     at proto_merge.js:2:3

     why

     Merging untrusted keys without a guard lets an input key of "__proto__", "constructor", or "prototype" mutate Object.prototype, corrupting every object in the process (privilege escalation, DoS, RCE gadgets).

     fix

     Guard every copied key: skip "__proto__"/"constructor"/"prototype", use Object.hasOwn(src, key) before recursing, or build the target with Object.create(null). Prefer a vetted deep-merge library.

  3. After --fix

     function deepMerge(target, source) {
       for (const key in source) {
     +    if (key === "__proto__" || key === "constructor" || key === "prototype") continue;
         if (source[key] && typeof source[key] === "object") {
           target[key] = deepMerge(target[key] || {}, source[key]);
         } else {
           target[key] = source[key];
         }
       }
       return target;
     }
     
     function applyOverride(obj, patch) {
       obj.__proto__.polluted = patch;
       return obj;
     }
     
     module.exports = { deepMerge, applyOverride };

     Skip prototype keys in the merge loop

     Findings still open after --fix: 1

• 1. Before

     #include <WiFiClientSecure.h>
     #include <HTTPClient.h>
     
     WiFiClientSecure client;
     
     void fetch() {
       client.setInsecure();
       HTTPClient http;
       http.begin("http://api.example.com/telemetry");
       http.GET();
     }

  2. VibeGuard says

     MEDIUMCleartext HTTP endpoint from device[VG-EMB-010](confidence: medium)

     at net_insecure.ino:9:14

     why

     Plaintext HTTP on a device has no confidentiality or integrity: credentials, telemetry, and firmware updates can be read and altered on the wire.

     fix

     Use https:// with certificate validation (setCACert / a pinned root). If the endpoint is truly local and trusted, keep it off any routable network.

  3. After --fix

     #include <WiFiClientSecure.h>
     #include <HTTPClient.h>
     
     WiFiClientSecure client;
     
     void fetch() {
       client.setInsecure();
       HTTPClient http;
     +  http.begin("https://api.example.com/telemetry");
       http.GET();
     }

     Use https for the endpoint

     Findings still open after --fix: 1

• 1. Before

     #define DEBUG 1
     #define BYPASS_AUTH 1
     
     const char* password = "loginpw";
     
     void setup() {
       Serial.begin(115200);
     }
     
     void loop() {
       Serial.println(password);
       // TODO: remove before production
     }

  2. VibeGuard says

     HIGHAuth / security bypass flag[VG-EMB-021](confidence: medium)

     at debug_remnants.ino:2:1

     why

     A shipped bypass flag is a backdoor: whoever knows it (and it is in the firmware) skips authentication or verification entirely.

     fix

     Remove the bypass path. If a test hook is genuinely needed, gate it behind a build type that cannot be selected for release, not a runtime flag.

  3. After --fix

     +#define DEBUG 0
     +#define BYPASS_AUTH 0
     
     const char* password = "loginpw";
     
     void setup() {
       Serial.begin(115200);
     }
     
     void loop() {
       Serial.println(password);
       // TODO: remove before production
     }

     Turn the bypass flag off

     Findings still open after --fix: 3

Fixers exist for 7 of the 78 rules — 6 labelled needs-review, 1 labelled safe. VibeGuard offers an edit only for those, only when you pass --fix, and an edit it cannot show to be correct is not made: the finding stays instead. Every other rule is reported and left alone. See which rules have a fixer.