Detection rules Available
Every rule VibeGuard ships — 78 that judge a file on its own, and 11 more that reason across files. Generated from the rule sources at build time.
- Single-file rules
- 78
- Cross-file rules
- 11
- Languages
- 11
- With an automatic fix
- 7
- Of those, safe to apply unread
- 1
Most rules carry no automatic fix, and that is the honest state of it: 7 of 78 have one, 6 of those change behaviour and are marked for review, and only 1 is declared safe to apply without reading the change. The rest of the catalogue tells you where to look and why. The edit stays yours.
Languages covered: c cpp csharp go java javascript kotlin php python ruby typescript
Injection
SQL, command, eval, deserialization, template
Use of eval() VG-INJ-004
Unsafe deserialization (pickle / yaml.load) VG-INJ-005
Runtime.exec / ProcessBuilder with string concatenation VG-INJ-010
ObjectInputStream.readObject on untrusted input VG-INJ-012
Ruby eval / instance_eval / class_eval with non-literal VG-INJ-014
extract() on a request superglobal VG-INJ-016
include / require with a variable path VG-INJ-017
unserialize() on potentially untrusted input VG-INJ-018
SQL string concatenation VG-INJ-001
subprocess with shell=True and dynamic args VG-INJ-002
os.system / os.popen with interpolated input VG-INJ-003
innerHTML assignment with non-literal value VG-INJ-006
Go SQL query built with fmt.Sprintf VG-INJ-008
html/template.HTML() cast bypasses escaping VG-INJ-009
XML parser configured without disabling external entities (XXE) VG-INJ-011
Rails raw() / html_safe on non-literal input VG-INJ-013
Rails params.permit! (mass assignment open to every attribute) VG-INJ-015
mysql_query / mysqli_query with string concatenation VG-INJ-019
Prototype-polluting merge VG-INJ-020
Fix offered: Skip prototype keys in the merge loop.
Path built from string concatenation VG-INJ-007
Hardcoded secrets
AWS keys, PEM blocks, GitHub tokens, API keys
Hard-coded AWS access key ID VG-SEC-001
Embedded PEM private key VG-SEC-002
Embedded GitHub personal access token VG-SEC-004
Embedded model-provider API key VG-SEC-005
Likely API key / secret in literal VG-SEC-003
Auth & access control
Debug bypasses, placeholder tokens, role checks by string literal
Authentication bypass when DEBUG is enabled VG-AUTH-001
Dummy or placeholder credential string VG-AUTH-003
TLS certificate verification disabled VG-AUTH-004
Django @csrf_exempt decorator disables CSRF protection VG-AUTH-005
Express session cookie missing secure / httpOnly flag VG-AUTH-006
Rails CSRF protection disabled or weakened VG-AUTH-007
Authorization decided by assert() VG-AUTH-008
Access control that only runs in development VG-AUTH-009
Authorization decided by console.assert VG-AUTH-010
Authorization decided by assert (Python) VG-AUTH-011
TODO comment near security-critical code VG-AUTH-002
Long Security Method VG-SMELL-003
Primitive Role Check VG-SMELL-012
Security Swiss Army Knife VG-SMELL-004
Weak crypto & cleartext
MD5/SHA1, Math.random, http:// endpoints
Weak hash (MD5 / SHA1) used in security context VG-CRYPTO-001
Non-cryptographic random used for tokens / IDs VG-CRYPTO-002
http:// URL used for non-localhost endpoint VG-CRYPTO-003
Framework misconfig
Django DEBUG, Flask debug=True, CORS wildcard
Flask app.run(debug=True) — Werkzeug debugger reachable VG-FW-002
Django DEBUG = True in settings VG-FW-001
CORS configured with wildcard origin VG-FW-003
Go http.ListenAndServe on all interfaces without TLS VG-FW-004
Memory safety (C/C++)
gets, strcpy, memcpy sized from strlen, same-block use-after-free
gets() — unbounded stack read VG-MEM-001
Unbounded string copy (strcpy / strcat / sprintf) VG-MEM-002
Double free on the same pointer (straight-line) VG-MEM-004
Use after free (straight-line) VG-MEM-005
memcpy / memmove sized from the source (strlen) VG-MEM-003
Secret buffer cleared with a removable memset VG-MEM-006
AI leftovers
Stub implementations, placeholder emails, "for now" comments, near-miss imports
Mock / Dummy Security Leftover VG-AISC-004
CORS wildcard origin with credentials VG-QUAL-002
Hallucinated Dependency VG-AISC-001
Fix offered: Rename the import to the package it near-misses.
Empty except / catch block VG-QUAL-001
Logging a secret-named variable VG-QUAL-003
Redirect to a value derived from request input VG-QUAL-004
Stub or not-implemented function body VG-QUAL-005
Placeholder email address in source VG-QUAL-006
Debug / verbose flag hardcoded ON VG-QUAL-008
"Not for production" / "for now" placeholder comment VG-QUAL-009
Validator / sanitizer with passthrough body VG-QUAL-010
Mock / fake / dummy identifier outside test paths VG-QUAL-007
Embedded & RTOS
Hard-coded Wi-Fi creds, setInsecure(), #define DEBUG 1, ISR-unsafe calls
Hard-coded Wi-Fi credentials VG-EMB-001
Secret assigned to a credential-named identifier VG-EMB-002
TLS certificate verification disabled VG-EMB-011
Fix offered: Require certificate verification.
Auth / security bypass flag VG-EMB-021
Fix offered: Turn the bypass flag off.
Forbidden call inside an interrupt handler VG-RTOS-001
Static BLE pairing passkey VG-EMB-003
Cleartext HTTP endpoint from device VG-EMB-010
Fix offered: Use https for the endpoint.
BLE Just Works / no-MITM pairing constant VG-EMB-012
#define DEBUG 1 left on in firmware VG-EMB-020
Fix offered: Set the debug define to 0.
Credential printed to serial VG-EMB-022
"Remove before production" reminder comment VG-EMB-023
Shared ISR variable missing volatile VG-RTOS-002
Peripheral used before begin() in setup() VG-EMB-031
O_DIRECT open without O_SYNC (NuttX) VG-RTOS-004
Fix offered: Add O_SYNC for durability.
Cross-file design smells
A further set of rules reasons across files rather than within one — authorization decided in a dozen handlers instead of one boundary, a generated validator that nothing ever calls, a variable an interrupt writes and another file reads. These run only with --include-design-smells, in the CLI and the GitHub Action. They are not bundled into the VS Code or Chrome extensions.
The GitHub Action and the CLI are two of the four ways to install VibeGuard.
Hallucinated API / Symbol VG-AISC-002
Unintegrated Generated Security VG-AISC-003
Temporal Security Coupling VG-SMELL-041
Shared ISR variable missing volatile (cross-file) VG-RTOS-003
Scattered Authorization VG-SMELL-010
Missing Central Auth Boundary VG-SMELL-011
Inline Authorization Logic VG-SMELL-013
Cyclic Security Dependency VG-SMELL-020
High Fan-out Security Module VG-SMELL-021
Refused Security Inheritance VG-SMELL-030
Generated Boilerplate Without Integration VG-SMELL-052