Loading VibeLint...
The detailed security risks VibeLint checks in AI-generated and project code, organized by vulnerability instead of internal scanner names.
01 / Credentials and secrets
VibeLint looks for credentials and sensitive values that should never be committed, bundled, logged, or copied with source code.
02 / Identity and sessions
These checks focus on authentication code that looks functional but weakens password, token, session, or credential security.
03 / Untrusted input
VibeLint checks whether untrusted input is composed into database operations, browser rendering, operating-system commands, or dynamic code execution.
04 / Application boundaries
Configuration written for a quick local demo can create serious exposure when it reaches a shared, staging, or production environment.
05 / Protected operations
VibeLint checks API routes for evidence that callers are authenticated and that sensitive actions have an explicit role, permission, or scope decision.
06 / Abuse resistance
Sensitive and write-heavy endpoints need meaningful request limits to resist brute force, automation abuse, and resource exhaustion.
07 / AI-native threats
AI inputs and outputs are untrusted data. VibeLint follows risky input into model calls and looks for model output that reaches execution-capable functions.
08 / Expanded language coverage
The Free tier also runs a broad security-audit ruleset. These findings extend coverage across supported languages and may overlap with some specialized checks.
09 / Software supply chain
VibeLint checks pinned dependencies against current vulnerability advisories and retains offline fallback coverage for important known issues.
A finding identifies a risky pattern or a missing security control. It does not automatically prove that the code is exploitable. Review the surrounding code, confirm the data flow and runtime configuration, then apply or adapt the suggested fix.