@vibecheck-ai/cli 23.2.0 → 24.0.1

package/README.md

@@ -2,7 +2,7 @@
 
 <br />
 
-<img src="https://github.com/guardiavault-oss/Vibecheck/raw/HEAD/packages/vscode-extension/images/vibecheck_logo_transparent_2x.png" alt="VibeCheck CLI" width="80" />
+<img src="https://github.com/vibecheck-oss/vibecheck/raw/HEAD/packages/vscode-extension/images/vibecheck_logo_transparent_2x.png" alt="VibeCheck CLI" width="80" />
 
 <br />
 
@@ -21,7 +21,7 @@ Catches phantom dependencies, ghost API routes, fake SDK methods, credential lea
 <br />
 
 <p align="center">
-  <img src="https://github.com/guardiavault-oss/Vibecheck/raw/HEAD/docs/assets/cli-scan-demo.gif" alt="VibeCheck CLI scanning a project in real time" width="820" />
+  <img src="https://github.com/vibecheck-oss/vibecheck/raw/HEAD/docs/assets/cli-scan-demo.gif" alt="VibeCheck CLI scanning a project in real time" width="820" />
 </p>
 
 <br />
@@ -43,7 +43,7 @@ Every AI coding tool — **Cursor, Copilot, Claude, Windsurf, ChatGPT** — prod
 
 Your linter says it's fine. TypeScript says it's fine. PR review says it's fine.
 
-**VibeCheck catches what they miss.** 17 detection engines. One command. Zero config.
+**VibeCheck catches what they miss.** 14 detection engines. One command. Zero config.
 
 <br />
 
@@ -67,10 +67,14 @@ vc scan .
 
 That's it. No config files. No API keys. No setup wizard.
 
+### API compatibility
+
+When you sign in and use **server-backed daily scan limits**, the CLI must be a **current release** (24.x or newer as of this major). The API rejects legacy clients without up-to-date scan metering headers. If you see `SCAN_CLIENT_UPGRADE_REQUIRED`, run `npm i -g @vibecheck-ai/cli@latest` (or use `npx @vibecheck-ai/cli@latest`).
+
 <br />
 
 <p align="center">
-  <img src="https://github.com/guardiavault-oss/Vibecheck/raw/HEAD/docs/assets/cli-quickstart.png" alt="VibeCheck CLI quick start output" width="720" />
+  <img src="https://github.com/vibecheck-oss/vibecheck/raw/HEAD/docs/assets/cli-quickstart.png" alt="VibeCheck CLI quick start output" width="720" />
 </p>
 
 <br />
@@ -79,29 +83,26 @@ That's it. No config files. No API keys. No setup wizard.
 
 <br />
 
-## 17 Detection Engines
+## 14 Detection Engines
 
-Every engine is purpose-built for a specific failure mode that traditional tools miss.
+Every engine is purpose-built for a specific failure mode that traditional tools miss. These map to the engines registered by the CLI `FileRunner` (workspace engines + baseline registry).
 
 | # | Engine | What it catches |
 |:---:|:---|:---|
-| 1 | **Ghost Routes** | API calls to endpoints that were never implemented |
-| 2 | **Dead UI** | Buttons, forms, and links wired to empty or missing handlers |
-| 3 | **Phantom Imports** | Modules and packages referenced but never installed |
-| 4 | **Silent Failures** | Try/catch blocks that swallow errors without handling them |
-| 5 | **Hardcoded Mocks** | Test data, fake values, and stubs left in production paths |
-| 6 | **Credential Leaks** | API keys, tokens, passwords, and secrets committed to source |
-| 7 | **Env Drift** | Environment variable references that don't exist in `.env` |
-| 8 | **Auth Gaps** | Middleware or guards referencing nonexistent auth providers |
-| 9 | **Type Holes** | `@ts-ignore`, `any` casts, unsafe assertions hiding real bugs |
-| 10 | **Console Pollution** | `console.log`, `console.debug` left in production bundles |
-| 11 | **Version Hallucinations** | API calls that don't exist in the installed package version |
-| 12 | **Slopsquatting** | Misspelled package names that could be typosquat attacks |
-| 13 | **Architectural Drift** | Code that violates your project's structural patterns |
-| 14 | **Dependency Vulnerabilities** | Known CVEs in your dependency tree |
-| 15 | **Performance Anti-patterns** | JSON parsing in loops, sync I/O in async paths |
-| 16 | **Accessibility Violations** | Missing ARIA labels, incorrect roles, keyboard traps |
-| 17 | **Contract Drift** | Code that diverged from its ISL/OpenAPI specification |
+| 1 | **Undefined env vars** | `process.env` references not backed by your env / truthpack |
+| 2 | **Ghost routes** | `fetch` and client calls to API paths with no handler |
+| 3 | **Phantom dependencies** | Imports of packages not declared or not resolvable |
+| 4 | **API hallucinations** | SDK or API usage that does not exist for your stack |
+| 5 | **Hardcoded secrets** | Keys, tokens, and passwords committed to source |
+| 6 | **Security vulnerabilities** | Injection, XSS, SSRF, weak crypto, and related OWASP-style issues |
+| 7 | **Fake features** | Placeholder flags, empty handlers, mock data in prod paths |
+| 8 | **Version mismatches** | APIs used in ways incompatible with installed package versions |
+| 9 | **Logic gaps** | Contradictory or impossible control flow |
+| 10 | **Error-handling gaps** | Swallowed errors, risky `try`/`catch` shape, unchecked async results |
+| 11 | **Incomplete implementation** | Stubs, empty bodies, and unfinished paths |
+| 12 | **Type contracts** | Types asserted vs actual JSON/API shape mismatches |
+| 13 | **Security patterns** | Unprotected routes, CSRF, JWT misuse, redirects, CSP gaps |
+| 14 | **Performance anti-patterns** | N+1 queries, sync I/O in async paths, fetch-in-render, and similar |
 
 <br />
 
@@ -478,7 +479,7 @@ eval "$(vibecheck completion zsh)"
 - All scanning runs **locally on your machine**
 - **Zero code is transmitted** — ever
 - Works **fully offline** and in air-gapped environments
-- [Open source](https://github.com/guardiavault-oss/Vibecheck) — read every line
+- [Open source](https://github.com/vibecheck-oss/vibecheck) — read every line
 
 <br />
 
@@ -492,7 +493,7 @@ eval "$(vibecheck completion zsh)"
 
 <br />
 
-[Website](https://vibecheckai.dev) &nbsp;&nbsp;·&nbsp;&nbsp; [Documentation](https://docs.vibecheckai.dev) &nbsp;&nbsp;·&nbsp;&nbsp; [Discord](https://discord.gg/vibecheck) &nbsp;&nbsp;·&nbsp;&nbsp; [GitHub](https://github.com/guardiavault-oss/Vibecheck)
+[Website](https://vibecheckai.dev) &nbsp;&nbsp;·&nbsp;&nbsp; [Documentation](https://docs.vibecheckai.dev) &nbsp;&nbsp;·&nbsp;&nbsp; [Discord](https://discord.gg/vibecheck) &nbsp;&nbsp;·&nbsp;&nbsp; [GitHub](https://github.com/vibecheck-oss/vibecheck)
 
 <br />