@all-safe-projects/allsafe-vibeguard 0.1.0

package/LICENSE

@@ -0,0 +1,38 @@
+AllSafe VibeGuard Proprietary License
+Version 1.0, 2026
+
+Copyright (c) 2026 All Safe Areas. All rights reserved.
+
+Subject to these terms, All Safe Areas grants you a limited, revocable,
+non-exclusive, non-transferable right to download, install, and execute an
+unmodified copy of AllSafe VibeGuard solely for internal security evaluation
+and source-code scanning.
+
+You may not, without prior written permission from All Safe Areas:
+
+1. modify, adapt, translate, or create derivative works of the software;
+2. copy or redistribute the software except for copies strictly necessary for
+   the permitted internal use;
+3. publish, sublicense, sell, rent, lease, or otherwise transfer the software;
+4. provide the software or its functionality as a hosted, managed, or
+   commercial service;
+5. remove or alter copyright, attribution, or proprietary notices;
+6. reverse engineer, decompile, or disassemble the software, except only to
+   the extent such restriction is prohibited by applicable law; or
+7. use the software to violate applicable law or the rights of another party.
+
+No rights are granted to any source code, trademark, service mark, logo,
+patent, or other intellectual property except the limited execution right
+stated above. All rights not expressly granted are reserved by All Safe Areas.
+
+THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE, TITLE, AND NON-INFRINGEMENT. TO THE MAXIMUM EXTENT PERMITTED BY LAW,
+ALL SAFE AREAS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL,
+CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOSS OF DATA, PROFITS, OR BUSINESS,
+ARISING FROM OR RELATED TO THE SOFTWARE OR ITS USE.
+
+These terms terminate automatically if you breach them. On termination, you
+must stop using the software and delete all copies in your possession or
+control. Additional rights may be granted only by a separate written agreement
+signed by All Safe Areas.

package/README.md

@@ -0,0 +1,90 @@
+# AllSafe VibeGuard
+
+AllSafe VibeGuard is a local security deployment gate for JavaScript and TypeScript projects generated or modified with AI tools. It scans source files on your machine and reports high-risk patterns before deployment.
+
+> Experimental MVP. VibeGuard is a focused static checker, not a replacement for code review, dependency auditing, penetration testing, or a complete SAST platform.
+
+## Quick start
+
+Node.js 20 or newer is required.
+
+```bash
+npx @all-safe-projects/allsafe-vibeguard scan .
+```
+
+The scanner reads the selected local directory. It does not upload project source code.
+
+## CLI
+
+```text
+allsafe-vibe scan [path] [options]
+allsafe-vibe [path] [options]
+
+Options:
+  --json                  Print JSON
+  --fail-on <severity>    critical, high, medium, low, none
+  --no-color              Disable terminal colors
+  -h, --help              Show help
+  -v, --version           Show version
+```
+
+Examples:
+
+```bash
+npx @all-safe-projects/allsafe-vibeguard scan . --fail-on medium
+npx @all-safe-projects/allsafe-vibeguard scan ./services/api --json
+```
+
+The default failure threshold is `high`. Exit code `0` means the configured threshold was not reached, `1` means it was reached, and `2` means the scan could not complete.
+
+## Current checks
+
+- Embedded private keys and credentials shaped like AWS, GitHub, or Stripe secrets
+- Hardcoded passwords, tokens, API keys, and sensitive `.env` files
+- Predictable JWT secret fallbacks and JWT decoding without signature verification
+- Potential SSRF, command injection, path traversal, and dynamic code execution
+- Disabled TLS certificate verification and wildcard CORS configuration
+
+Each finding includes severity, confidence, evidence with common credentials redacted, impact, and a remediation suggestion.
+
+## Verdicts
+
+| Verdict | Meaning |
+| --- | --- |
+| `PASS` | No findings were detected by the current rule set. |
+| `REVIEW` | One or more low or medium findings require review. |
+| `BLOCK` | One or more high or critical findings were detected. |
+
+## Programmatic API
+
+```js
+import { scanProject } from "@all-safe-projects/allsafe-vibeguard";
+
+const result = await scanProject(".");
+console.log(result.verdict, result.findings);
+```
+
+Optional resource limits can be overridden for controlled environments:
+
+```js
+const result = await scanProject(".", {
+  limits: {
+    maxFiles: 5_000,
+    timeoutMs: 15_000
+  }
+});
+```
+
+Default limits protect the scanner from unexpectedly large or hostile directory trees: 10,000 files, 5,000 directories, depth 30, 25 MB total scanned content, 1 MB per file, 1,000 findings, and 30 seconds. Exceeding a limit stops the scan with exit code `2`; it does not silently return an incomplete result.
+
+## Limitations
+
+VibeGuard uses focused pattern-based checks. It can produce false positives and false negatives, and a `PASS` result is not proof that an application is secure. Review findings in context and use layered security testing before production deployment.
+
+## Security reports
+
+Report vulnerabilities through the [All Safe Areas vulnerability disclosure page](https://allsafeareas.org/security/vulnerability-disclosure).
+
+## License
+
+This package is proprietary and distributed as `UNLICENSED`. Limited internal-use rights and restrictions are stated in [LICENSE](./LICENSE).

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import process from "node:process";
+import { formatTerminalReport } from "./reporters/terminal.js";
+import { scanProject } from "./scanner.js";
+const SEVERITY_ORDER = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1
+};
+function readPackageVersion() {
+    try {
+        const packageJsonUrl = new URL("../package.json", import.meta.url);
+        const packageJson = JSON.parse(readFileSync(packageJsonUrl, "utf8"));
+        return packageJson.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function printHelp() {
+    console.log(`AllSafe VibeGuard ${readPackageVersion()}
+
+Usage:
+  allsafe-vibe scan [path] [options]
+  allsafe-vibe [path] [options]
+
+Options:
+  --json                  Print JSON
+  --fail-on <severity>    critical, high, medium, low, none
+  --no-color              Disable terminal colors
+  -h, --help              Show help
+  -v, --version           Show version
+
+Examples:
+  allsafe-vibe scan .
+  allsafe-vibe scan ./services/api
+  allsafe-vibe scan . --json
+  allsafe-vibe scan . --fail-on medium
+`);
+}
+function parseFailThreshold(value) {
+    if (value === "critical" ||
+        value === "high" ||
+        value === "medium" ||
+        value === "low" ||
+        value === "none") {
+        return value;
+    }
+    throw new Error("--fail-on must be critical, high, medium, low, or none");
+}
+function parseArguments(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        printHelp();
+        return null;
+    }
+    if (args.includes("--version") ||
+        args.includes("-v")) {
+        console.log(readPackageVersion());
+        return null;
+    }
+    const remaining = [...args];
+    if (remaining[0] === "scan") {
+        remaining.shift();
+    }
+    let target = ".";
+    let json = false;
+    let color = true;
+    let failOn = "high";
+    for (let index = 0; index < remaining.length; index += 1) {
+        const argument = remaining[index];
+        if (!argument) {
+            continue;
+        }
+        if (argument === "--json") {
+            json = true;
+            continue;
+        }
+        if (argument === "--no-color") {
+            color = false;
+            continue;
+        }
+        if (argument === "--fail-on") {
+            failOn = parseFailThreshold(remaining[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (argument.startsWith("--fail-on=")) {
+            failOn = parseFailThreshold(argument.slice("--fail-on=".length));
+            continue;
+        }
+        if (argument.startsWith("-")) {
+            throw new Error(`Unknown option: ${argument}`);
+        }
+        if (target !== ".") {
+            throw new Error(`Unexpected extra path: ${argument}`);
+        }
+        target = argument;
+    }
+    return {
+        target: resolve(target),
+        json,
+        color,
+        failOn
+    };
+}
+function shouldFail(findings, threshold) {
+    if (threshold === "none") {
+        return false;
+    }
+    return findings.some((finding) => SEVERITY_ORDER[finding.severity] >=
+        SEVERITY_ORDER[threshold]);
+}
+async function main() {
+    try {
+        const options = parseArguments(process.argv.slice(2));
+        if (!options) {
+            return;
+        }
+        const result = await scanProject(options.target);
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+        }
+        else {
+            console.log(formatTerminalReport(result, options.color));
+        }
+        process.exitCode = shouldFail(result.findings, options.failOn)
+            ? 1
+            : 0;
+    }
+    catch (error) {
+        console.error(`AllSafe VibeGuard error: ${error instanceof Error
+            ? error.message
+            : String(error)}`);
+        process.exitCode = 2;
+    }
+}
+void main();

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { scanProject } from "./scanner.js";
+export type { Confidence, Finding, FindingSummary, ScanLimits, ScanOptions, ScanResult, Severity, Verdict } from "./types.js";

package/dist/index.js

@@ -0,0 +1 @@
+export { scanProject } from "./scanner.js";

package/dist/reporters/terminal.d.ts

@@ -0,0 +1,2 @@
+import type { ScanResult } from "../types.js";
+export declare function formatTerminalReport(result: ScanResult, useColor?: boolean): string;

package/dist/reporters/terminal.js

@@ -0,0 +1,60 @@
+import { sanitizeTerminalText } from "../utils/evidence.js";
+const ANSI = {
+    reset: "\u001b[0m",
+    bold: "\u001b[1m",
+    red: "\u001b[31m",
+    yellow: "\u001b[33m",
+    blue: "\u001b[34m",
+    green: "\u001b[32m",
+    gray: "\u001b[90m"
+};
+function paint(text, code, enabled) {
+    return enabled
+        ? `${code}${text}${ANSI.reset}`
+        : text;
+}
+function severityColor(severity) {
+    switch (severity) {
+        case "critical":
+        case "high":
+            return ANSI.red;
+        case "medium":
+            return ANSI.yellow;
+        case "low":
+            return ANSI.blue;
+    }
+}
+function formatFinding(finding, useColor) {
+    const severity = paint(finding.severity.toUpperCase().padEnd(8), severityColor(finding.severity), useColor);
+    const safe = (value) => sanitizeTerminalText(value);
+    return [
+        `${severity} ${safe(finding.id)}  ${safe(finding.title)}`,
+        `         ${safe(finding.file)}:${finding.line}`,
+        `         Evidence: ${safe(finding.evidence)}`,
+        `         Risk: ${safe(finding.impact)}`,
+        `         Fix: ${safe(finding.remediation)}`
+    ].join("\n");
+}
+export function formatTerminalReport(result, useColor = Boolean(process.stdout.isTTY)) {
+    const verdictColor = result.verdict === "PASS"
+        ? ANSI.green
+        : result.verdict === "REVIEW"
+            ? ANSI.yellow
+            : ANSI.red;
+    const header = [
+        paint("AllSafe VibeGuard", ANSI.bold, useColor),
+        `Target:  ${sanitizeTerminalText(result.root)}`,
+        `Verdict: ${paint(result.verdict, verdictColor, useColor)}`,
+        `Score:   ${result.score}/100`,
+        `Files:   ${result.scannedFiles}`,
+        `Time:    ${result.durationMs} ms`,
+        `Issues:  ${result.summary.critical} critical, ${result.summary.high} high, ${result.summary.medium} medium, ${result.summary.low} low`
+    ].join("\n");
+    if (result.findings.length === 0) {
+        return `${header}\n\n${paint("No findings detected by the current rule set.", ANSI.green, useColor)}`;
+    }
+    const findings = result.findings
+        .map((finding) => formatFinding(finding, useColor))
+        .join("\n\n");
+    return `${header}\n\n${findings}\n\n${paint("This scan is not proof that the application is secure.", ANSI.gray, useColor)}`;
+}

package/dist/rules/dangerous-code.d.ts

@@ -0,0 +1,2 @@
+import type { Finding, ProjectFile } from "../types.js";
+export declare function scanDangerousCode(files: ProjectFile[]): Finding[];

package/dist/rules/dangerous-code.js

@@ -0,0 +1,129 @@
+import { redactEvidence } from "../utils/evidence.js";
+const CODE_PATTERNS = [
+    {
+        id: "ASA-CODE-001",
+        title: "Dynamic code execution with eval",
+        severity: "high",
+        category: "code-execution",
+        confidence: "high",
+        regex: /\beval\s*\(/,
+        explanation: "The application executes text as JavaScript code.",
+        impact: "If an attacker controls the value, this may become arbitrary code execution.",
+        remediation: "Remove eval. Parse a strict data format or map operations to predefined functions."
+    },
+    {
+        id: "ASA-CODE-002",
+        title: "Dynamic Function constructor",
+        severity: "high",
+        category: "code-execution",
+        confidence: "high",
+        regex: /\bnew\s+Function\s*\(/,
+        explanation: "The Function constructor compiles a string into executable JavaScript.",
+        impact: "Attacker-controlled input may lead to arbitrary code execution.",
+        remediation: "Replace dynamic code generation with explicit allowlisted operations."
+    },
+    {
+        id: "ASA-CMD-001",
+        title: "Possible command injection",
+        severity: "critical",
+        category: "command-injection",
+        confidence: "medium",
+        regex: /\b(?:exec|execSync)\s*\([^\n]*(?:req|request)\.(?:body|query|params)/,
+        explanation: "A shell command appears to use data taken directly from an HTTP request.",
+        impact: "An attacker may execute operating-system commands with the application's privileges.",
+        remediation: "Avoid a shell. Use execFile or spawn with a fixed executable and strict argument allowlists."
+    },
+    {
+        id: "ASA-SSRF-001",
+        title: "Possible server-side request forgery",
+        severity: "critical",
+        category: "ssrf",
+        confidence: "medium",
+        regex: /\b(?:fetch|request|axios\.(?:get|post|request))\s*\([^\n]*(?:req|request)\.(?:body|query|params)/,
+        explanation: "A server-side request appears to use a URL supplied by the client.",
+        impact: "An attacker may access localhost, private networks, cloud metadata, or attacker-controlled endpoints.",
+        remediation: "Allowlist destinations, validate resolved IPs, block private ranges, restrict redirects, and isolate outbound workers."
+    },
+    {
+        id: "ASA-AUTH-001",
+        title: "Predictable JWT secret fallback",
+        severity: "critical",
+        category: "authentication",
+        confidence: "high",
+        regex: /process\.env\.[A-Z0-9_]*(?:JWT|SECRET)[A-Z0-9_]*\s*\|\|\s*["'`][^"'`]+["'`]/i,
+        explanation: "JWT signing falls back to a hardcoded value when an environment variable is missing.",
+        impact: "An attacker who knows the fallback may forge authentication tokens.",
+        remediation: "Fail application startup when the secret is absent. Never use a default signing secret."
+    },
+    {
+        id: "ASA-AUTH-002",
+        title: "JWT decoded without signature verification",
+        severity: "high",
+        category: "authentication",
+        confidence: "medium",
+        regex: /\b(?:jwt|jsonwebtoken)\.decode\s*\(/,
+        explanation: "The code decodes a JWT but may not verify its signature and claims.",
+        impact: "Untrusted token contents may be accepted as identity or authorization data.",
+        remediation: "Verify the signature, issuer, audience, expiry, and allowed algorithms."
+    },
+    {
+        id: "ASA-FILE-001",
+        title: "Possible path traversal",
+        severity: "high",
+        category: "path-traversal",
+        confidence: "medium",
+        regex: /\b(?:readFile|writeFile|createReadStream|sendFile)\s*\([^\n]*(?:req|request)\.(?:body|query|params)/,
+        explanation: "A filesystem path appears to use data supplied directly by the client.",
+        impact: "An attacker may read or overwrite files outside the intended directory.",
+        remediation: "Use server-side identifiers, canonical paths, and a fixed permitted base directory."
+    },
+    {
+        id: "ASA-TLS-001",
+        title: "TLS certificate verification disabled",
+        severity: "critical",
+        category: "transport-security",
+        confidence: "high",
+        regex: /(?:rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*["']?0)/,
+        explanation: "The application disables TLS certificate validation.",
+        impact: "An attacker on the network may intercept or modify encrypted traffic.",
+        remediation: "Restore certificate validation and configure the correct trusted CA."
+    },
+    {
+        id: "ASA-CORS-001",
+        title: "Wildcard CORS origin",
+        severity: "medium",
+        category: "cors",
+        confidence: "low",
+        regex: /origin\s*:\s*["']\*["']/,
+        explanation: "The CORS configuration appears to allow every web origin.",
+        impact: "Untrusted websites may call the application from a victim's browser.",
+        remediation: "Use an explicit origin allowlist and reject unknown origins."
+    }
+];
+export function scanDangerousCode(files) {
+    const findings = [];
+    for (const file of files) {
+        const lines = file.content.split(/\r?\n/);
+        lines.forEach((line, index) => {
+            for (const pattern of CODE_PATTERNS) {
+                if (!pattern.regex.test(line)) {
+                    continue;
+                }
+                findings.push({
+                    id: pattern.id,
+                    title: pattern.title,
+                    severity: pattern.severity,
+                    category: pattern.category,
+                    file: file.relativePath,
+                    line: index + 1,
+                    evidence: redactEvidence(line),
+                    explanation: pattern.explanation,
+                    impact: pattern.impact,
+                    remediation: pattern.remediation,
+                    confidence: pattern.confidence
+                });
+            }
+        });
+    }
+    return findings;
+}

package/dist/rules/secrets.d.ts

@@ -0,0 +1,2 @@
+import type { Finding, ProjectFile } from "../types.js";
+export declare function scanSecrets(files: ProjectFile[]): Finding[];

package/dist/rules/secrets.js

@@ -0,0 +1,125 @@
+import { redactEvidence } from "../utils/evidence.js";
+const SECRET_PATTERNS = [
+    {
+        id: "ASA-SECRET-001",
+        title: "Private key embedded in the project",
+        regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+        explanation: "A private cryptographic key appears to be stored directly in a project file.",
+        impact: "Anyone who obtains the repository may impersonate the service or decrypt protected data.",
+        remediation: "Revoke and rotate the key, remove it from Git history, and use a secret manager."
+    },
+    {
+        id: "ASA-SECRET-002",
+        title: "AWS access key detected",
+        regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,
+        explanation: "The file contains a value shaped like an AWS access key.",
+        impact: "A leaked cloud credential may permit data theft, infrastructure changes, or unexpected charges.",
+        remediation: "Disable and rotate the credential, then use workload identity or a secret manager."
+    },
+    {
+        id: "ASA-SECRET-003",
+        title: "GitHub token detected",
+        regex: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/,
+        explanation: "The file contains a value shaped like a GitHub access token.",
+        impact: "The token may grant access to repositories, packages, workflows, or organization data.",
+        remediation: "Revoke the token, remove it from Git history, and use short-lived CI credentials."
+    },
+    {
+        id: "ASA-SECRET-004",
+        title: "Stripe live secret key detected",
+        regex: /\bsk_live_[A-Za-z0-9]{16,}\b/,
+        explanation: "The file contains a value shaped like a live Stripe secret key.",
+        impact: "An attacker may access payment data or execute privileged API operations.",
+        remediation: "Roll the key, remove the old value from Git history, and store the replacement securely."
+    }
+];
+const GENERIC_SECRET_REGEX = /["']?(?:api[_-]?key|client[_-]?secret|jwt[_-]?secret|password|passwd|token)["']?\s*[:=]\s*["'`]([^"'`\r\n]{8,})["'`]/i;
+function looksLikePlaceholder(value) {
+    const normalized = value.trim().toLowerCase();
+    return [
+        "process.env",
+        "import.meta.env",
+        "${",
+        "example",
+        "placeholder",
+        "changeme",
+        "change-me",
+        "dummy",
+        "your_",
+        "your-",
+        "<",
+        "undefined",
+        "null"
+    ].some((marker) => normalized.includes(marker));
+}
+function isSensitiveEnvFile(path) {
+    const fileName = path.split("/").at(-1) ?? path;
+    return (fileName.startsWith(".env") &&
+        !fileName.includes("example") &&
+        !fileName.includes("sample"));
+}
+export function scanSecrets(files) {
+    const findings = [];
+    for (const file of files) {
+        if (isSensitiveEnvFile(file.relativePath)) {
+            findings.push({
+                id: "ASA-CONFIG-001",
+                title: "Sensitive environment file present",
+                severity: "medium",
+                category: "secrets",
+                file: file.relativePath,
+                line: 1,
+                evidence: file.relativePath,
+                explanation: "A non-example .env file is present in the scan target.",
+                impact: "If committed, packaged, or exposed by the web server, application secrets may leak.",
+                remediation: "Exclude the file from Git and deployment images. Use a production secret store.",
+                confidence: "medium"
+            });
+        }
+        const lines = file.content.split(/\r?\n/);
+        lines.forEach((line, index) => {
+            let matchedSpecificPattern = false;
+            for (const pattern of SECRET_PATTERNS) {
+                if (!pattern.regex.test(line)) {
+                    continue;
+                }
+                matchedSpecificPattern = true;
+                findings.push({
+                    id: pattern.id,
+                    title: pattern.title,
+                    severity: "critical",
+                    category: "secrets",
+                    file: file.relativePath,
+                    line: index + 1,
+                    evidence: redactEvidence(line),
+                    explanation: pattern.explanation,
+                    impact: pattern.impact,
+                    remediation: pattern.remediation,
+                    confidence: "high"
+                });
+            }
+            if (matchedSpecificPattern) {
+                return;
+            }
+            const genericMatch = line.match(GENERIC_SECRET_REGEX);
+            const candidate = genericMatch?.[1];
+            if (!candidate || looksLikePlaceholder(candidate)) {
+                return;
+            }
+            findings.push({
+                id: "ASA-SECRET-005",
+                title: "Hardcoded credential or secret",
+                severity: "high",
+                category: "secrets",
+                file: file.relativePath,
+                line: index + 1,
+                evidence: redactEvidence(line),
+                explanation: "A password, token, API key, or secret appears to use a literal value.",
+                impact: "The credential may leak through source control, backups, logs, build artifacts, or client bundles.",
+                remediation: "Move the value to a secret manager or protected environment variable and rotate it.",
+                confidence: "medium"
+            });
+        });
+    }
+    return findings;
+}

package/dist/scanner.d.ts

@@ -0,0 +1,2 @@
+import type { ScanOptions, ScanResult } from "./types.js";
+export declare function scanProject(projectRoot: string, options?: ScanOptions): Promise<ScanResult>;

package/dist/scanner.js

@@ -0,0 +1,91 @@
+import { resolve } from "node:path";
+import { performance } from "node:perf_hooks";
+import { scanDangerousCode } from "./rules/dangerous-code.js";
+import { scanSecrets } from "./rules/secrets.js";
+import { DEFAULT_SCAN_LIMITS, loadProjectFiles } from "./utils/files.js";
+const SEVERITY_ORDER = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1
+};
+const SCORE_PENALTIES = {
+    critical: 30,
+    high: 15,
+    medium: 7,
+    low: 2
+};
+function deduplicateFindings(findings) {
+    const unique = new Map();
+    for (const finding of findings) {
+        const key = `${finding.id}:${finding.file}:${finding.line}`;
+        unique.set(key, finding);
+    }
+    return [...unique.values()];
+}
+function sortFindings(findings) {
+    return findings.sort((left, right) => {
+        const severityDifference = SEVERITY_ORDER[right.severity] -
+            SEVERITY_ORDER[left.severity];
+        if (severityDifference !== 0) {
+            return severityDifference;
+        }
+        return (left.file.localeCompare(right.file) ||
+            left.line - right.line);
+    });
+}
+function buildSummary(findings) {
+    const summary = {
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0
+    };
+    for (const finding of findings) {
+        summary[finding.severity] += 1;
+    }
+    return summary;
+}
+function calculateScore(findings) {
+    const penalty = findings.reduce((total, finding) => total + SCORE_PENALTIES[finding.severity], 0);
+    return Math.max(0, 100 - penalty);
+}
+function calculateVerdict(summary) {
+    if (summary.critical > 0 || summary.high > 0) {
+        return "BLOCK";
+    }
+    if (summary.medium > 0 || summary.low > 0) {
+        return "REVIEW";
+    }
+    return "PASS";
+}
+export async function scanProject(projectRoot, options = {}) {
+    const startedAt = performance.now();
+    const root = resolve(projectRoot);
+    const limits = {
+        ...DEFAULT_SCAN_LIMITS,
+        ...options.limits
+    };
+    const files = await loadProjectFiles(root, limits);
+    const rawFindings = [
+        ...scanSecrets(files),
+        ...scanDangerousCode(files)
+    ];
+    if (rawFindings.length > limits.maxFindings) {
+        throw new Error(`Scan limit exceeded: findings (${limits.maxFindings})`);
+    }
+    if (performance.now() - startedAt > limits.timeoutMs) {
+        throw new Error(`Scan limit exceeded: timeout (${limits.timeoutMs} ms)`);
+    }
+    const findings = sortFindings(deduplicateFindings(rawFindings));
+    const summary = buildSummary(findings);
+    return {
+        root,
+        scannedFiles: files.length,
+        durationMs: Math.round(performance.now() - startedAt),
+        score: calculateScore(findings),
+        verdict: calculateVerdict(summary),
+        summary,
+        findings
+    };
+}

package/dist/types.d.ts

@@ -0,0 +1,48 @@
+export type Severity = "critical" | "high" | "medium" | "low";
+export type Confidence = "high" | "medium" | "low";
+export type Verdict = "PASS" | "REVIEW" | "BLOCK";
+export interface ProjectFile {
+    absolutePath: string;
+    relativePath: string;
+    content: string;
+}
+export interface ScanLimits {
+    maxFiles: number;
+    maxTotalBytes: number;
+    maxFileBytes: number;
+    maxDepth: number;
+    maxDirectories: number;
+    maxFindings: number;
+    timeoutMs: number;
+}
+export interface ScanOptions {
+    limits?: Partial<ScanLimits>;
+}
+export interface Finding {
+    id: string;
+    title: string;
+    severity: Severity;
+    category: string;
+    file: string;
+    line: number;
+    evidence: string;
+    explanation: string;
+    impact: string;
+    remediation: string;
+    confidence: Confidence;
+}
+export interface FindingSummary {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+}
+export interface ScanResult {
+    root: string;
+    scannedFiles: number;
+    durationMs: number;
+    score: number;
+    verdict: Verdict;
+    summary: FindingSummary;
+    findings: Finding[];
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/utils/evidence.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeTerminalText(value: string): string;
+export declare function redactEvidence(line: string): string;

package/dist/utils/evidence.js

@@ -0,0 +1,23 @@
+const MAX_EVIDENCE_LENGTH = 180;
+const ANSI_ESCAPE_SEQUENCE = /[\u001b\u009b](?:\][^\u0007]*(?:\u0007|\u001b\\)|[[\]()#;?]*(?:(?:[a-zA-Z\d]*(?:;[-a-zA-Z\d\/#&.:=?%@~_]+)*)?\u0007|(?:(?:\d{1,4}(?:[;:]\d{0,4})*)?[\dA-PR-TZcf-nq-uy=><~])))/g;
+const CONTROL_CHARACTERS = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g;
+const BIDI_CONTROL_CHARACTERS = /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
+export function sanitizeTerminalText(value) {
+    return value
+        .replace(ANSI_ESCAPE_SEQUENCE, "")
+        .replace(/[\r\n\t]+/g, " ")
+        .replace(CONTROL_CHARACTERS, "")
+        .replace(BIDI_CONTROL_CHARACTERS, "");
+}
+export function redactEvidence(line) {
+    const redacted = sanitizeTerminalText(line)
+        .trim()
+        .replace(/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "AKIA****************")
+        .replace(/\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g, "gh*_****************")
+        .replace(/\bsk_live_[A-Za-z0-9]{16,}\b/g, "sk_live_****************")
+        .replace(/(["']?(?:api[_-]?key|client[_-]?secret|jwt[_-]?secret|password|passwd|token)["']?\s*[:=]\s*["'`])([^"'`]+)(["'`])/gi, "$1[REDACTED]$3");
+    if (redacted.length <= MAX_EVIDENCE_LENGTH) {
+        return redacted;
+    }
+    return `${redacted.slice(0, MAX_EVIDENCE_LENGTH)}...`;
+}

package/dist/utils/files.d.ts

@@ -0,0 +1,3 @@
+import type { ProjectFile, ScanLimits } from "../types.js";
+export declare const DEFAULT_SCAN_LIMITS: ScanLimits;
+export declare function loadProjectFiles(projectRoot: string, limitOverrides?: Partial<ScanLimits>): Promise<ProjectFile[]>;

package/dist/utils/files.js

@@ -0,0 +1,171 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { basename, extname, join, relative, resolve } from "node:path";
+export const DEFAULT_SCAN_LIMITS = {
+    maxFiles: 10_000,
+    maxTotalBytes: 25_000_000,
+    maxFileBytes: 1_000_000,
+    maxDepth: 30,
+    maxDirectories: 5_000,
+    maxFindings: 1_000,
+    timeoutMs: 30_000
+};
+const SKIPPED_DIRECTORIES = new Set([
+    ".git",
+    ".next",
+    ".nuxt",
+    ".output",
+    ".turbo",
+    ".vite",
+    "build",
+    "coverage",
+    "dist",
+    "fixtures",
+    "node_modules",
+    "test",
+    "tests",
+    "vendor"
+]);
+const ALLOWED_EXTENSIONS = new Set([
+    ".cjs",
+    ".conf",
+    ".env",
+    ".html",
+    ".ini",
+    ".js",
+    ".json",
+    ".jsx",
+    ".mjs",
+    ".sh",
+    ".toml",
+    ".ts",
+    ".tsx",
+    ".yaml",
+    ".yml"
+]);
+const ALLOWED_FILE_NAMES = new Set([
+    "Dockerfile",
+    "docker-compose.yaml",
+    "docker-compose.yml",
+    "package.json"
+]);
+function normalizePath(path) {
+    return path.replaceAll("\\", "/");
+}
+function shouldScanFile(fileName) {
+    if (fileName.endsWith(".min.js") || fileName.endsWith(".min.css")) {
+        return false;
+    }
+    if (fileName === "package-lock.json" ||
+        fileName === "pnpm-lock.yaml" ||
+        fileName === "yarn.lock") {
+        return false;
+    }
+    if (fileName.startsWith(".env")) {
+        return true;
+    }
+    return (ALLOWED_FILE_NAMES.has(fileName) ||
+        ALLOWED_EXTENSIONS.has(extname(fileName)));
+}
+function resolveLimits(overrides) {
+    const limits = {
+        ...DEFAULT_SCAN_LIMITS,
+        ...overrides
+    };
+    for (const [name, value] of Object.entries(limits)) {
+        if (!Number.isFinite(value) || value <= 0) {
+            throw new Error(`Invalid scan limit ${name}: ${value}`);
+        }
+    }
+    return limits;
+}
+export async function loadProjectFiles(projectRoot, limitOverrides = {}) {
+    const limits = resolveLimits(limitOverrides);
+    const startedAt = Date.now();
+    const root = resolve(projectRoot);
+    const rootStats = await stat(root);
+    if (!rootStats.isDirectory()) {
+        throw new Error(`Scan target is not a directory: ${root}`);
+    }
+    const files = [];
+    let visitedFiles = 0;
+    let visitedDirectories = 1;
+    let totalBytes = 0;
+    function assertWithinTimeLimit() {
+        if (Date.now() - startedAt > limits.timeoutMs) {
+            throw new Error(`Scan limit exceeded: timeout (${limits.timeoutMs} ms)`);
+        }
+    }
+    async function walk(currentDirectory, depth) {
+        assertWithinTimeLimit();
+        let entries;
+        try {
+            entries = await readdir(currentDirectory, {
+                withFileTypes: true
+            });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            assertWithinTimeLimit();
+            if (entry.isSymbolicLink()) {
+                continue;
+            }
+            const absolutePath = join(currentDirectory, entry.name);
+            if (entry.isDirectory()) {
+                if (!SKIPPED_DIRECTORIES.has(entry.name)) {
+                    if (depth + 1 > limits.maxDepth) {
+                        throw new Error(`Scan limit exceeded: directory depth (${limits.maxDepth})`);
+                    }
+                    visitedDirectories += 1;
+                    if (visitedDirectories > limits.maxDirectories) {
+                        throw new Error(`Scan limit exceeded: directories (${limits.maxDirectories})`);
+                    }
+                    await walk(absolutePath, depth + 1);
+                }
+                continue;
+            }
+            if (!entry.isFile()) {
+                continue;
+            }
+            visitedFiles += 1;
+            if (visitedFiles > limits.maxFiles) {
+                throw new Error(`Scan limit exceeded: files (${limits.maxFiles})`);
+            }
+            if (!shouldScanFile(entry.name)) {
+                continue;
+            }
+            let fileStats;
+            try {
+                fileStats = await stat(absolutePath);
+            }
+            catch {
+                continue;
+            }
+            assertWithinTimeLimit();
+            if (fileStats.size > limits.maxFileBytes) {
+                continue;
+            }
+            if (totalBytes + fileStats.size > limits.maxTotalBytes) {
+                throw new Error(`Scan limit exceeded: total bytes (${limits.maxTotalBytes})`);
+            }
+            let content;
+            try {
+                content = await readFile(absolutePath, "utf8");
+            }
+            catch {
+                // Inaccessible or non-text files are skipped.
+                continue;
+            }
+            totalBytes += fileStats.size;
+            assertWithinTimeLimit();
+            files.push({
+                absolutePath,
+                relativePath: normalizePath(relative(root, absolutePath) || basename(absolutePath)),
+                content
+            });
+        }
+    }
+    await walk(root, 0);
+    return files;
+}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@all-safe-projects/allsafe-vibeguard",
+  "version": "0.1.0",
+  "description": "Local security deployment gate for AI-generated JavaScript and TypeScript applications",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "allsafe-vibe": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json && node scripts/make-executable.mjs",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "check": "npm run build && npm test",
+    "scan": "npm run build && node dist/cli.js scan",
+    "security:release": "bash scripts/prepublish-security-audit.sh",
+    "prepack": "npm run check",
+    "prepublishOnly": "npm run security:release"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "security",
+    "vibe-coding",
+    "cli",
+    "sast",
+    "ai-code",
+    "vulnerability-scanner",
+    "appsec"
+  ],
+  "author": "All Safe Areas",
+  "license": "UNLICENSED",
+  "homepage": "https://projects.allsafeareas.org/en-US/sensors-russia/npm-allsafe-vibecode",
+  "bugs": {
+    "url": "https://allsafeareas.org/security/vulnerability-disclosure"
+  },
+  "funding": "https://sponsor.allsafeareas.org/",
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}