DEV Community

Moon sehwan
Moon sehwan

Posted on

Add Security Scanning to Any GitHub Repo in 3 Lines of YAML

#devops #github #security #webdev

AI writes code fast. It also writes the same security bugs, over and over.

We scanned 10 popular vibe-coded repos (10k–100k ⭐) last week. Every single one had at least one critical issue that passed code review undetected.

The most common pattern:

# AI generates this constantly
def save_user(data):
    return {"status": "saved"}  # No actual DB write. Ever.

async def fetch_profile(user_id):
    return profile  # async keyword, zero await calls
Enter fullscreen mode Exit fullscreen mode

These aren't typos. They're structural patterns that emerge when LLMs write code — and standard linters miss all of them.

We built a scanner that catches them

AINAScan / VibeGuard — AST-based, deterministic, no LLM involved. 48 patterns across 9 languages.

And now it's a GitHub Action.

Add it to your repo in 3 lines 

# .github/workflows/vibeguard.yml
name: Security Scan
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Moonsehwan/aina-vibeguard-action@v1
        with:
          api-key: ${{ secrets.VIBEGUARD_KEY }}
Enter fullscreen mode Exit fullscreen mode

Add VIBEGUARD_KEY → Settings → Secrets → Actions → New secret

Use vg_free_test as the value (free promo key, valid until June 24).

That's it. Every PR now gets scanned. Critical issues fail the check automatically.

What it actually catches

Security patterns (33)

  • SQL injection via f-strings
  • Path traversal from unvalidated input
  • Command injection in subprocess calls
  • Hardcoded API keys and passwords
  • SSRF, XSS, eval/exec risks

Vibe-coding patterns (15) — unique to AINAScan

Pattern What it means
MISSING_WRITE save_user() with no INSERT/UPDATE anywhere
FAKE_ASYNC async def with zero await calls
STUB_SKELETON Function body is just return {}
DEAD_CALL_RESULT Calls 3 modules, ignores all return values
INPUT_OUTPUT_DISCONNECTED Parameters don't affect the return value

These patterns are in no other scanner. They exist because AI coding assistants repeat them constantly.

Real finding from last week

Scanned serena (25k ⭐) — a popular AI coding assistant:

[BLOCK] COMMAND_INJECTION  agent.py:1222
subprocess.Popen(cmd, shell=True)
→ any config value can execute arbitrary shell commands
Enter fullscreen mode Exit fullscreen mode

Found in 3 seconds. Missed by the maintainers.

Use the output in your agent workflow

The API returns structured JSON, so AI agents can auto-fix:

result = requests.post(
    "https://pleasing-transformation-production-90c2.up.railway.app/v1/scan",
    headers={"X-API-Key": "vg_free_test"},
    files={"file": open("app.py", "rb")}
).json()

# Pass to Claude/GPT for auto-fix
if not result["passed"]:
    prompt = f"Fix these issues: {result['issues']}"
    fixed = agent.generate(prompt)
Enter fullscreen mode Exit fullscreen mode

Try it now

Free key (until June 24): vg_free_test

curl -X POST https://pleasing-transformation-production-90c2.up.railway.app/v1/scan \
  -H "X-API-Key: vg_free_test" \
  -F "file=@your_file.py"
Enter fullscreen mode Exit fullscreen mode

GitHub Action: Moonsehwan/aina-vibeguard-action
Full docs: github.com/Moonsehwan/aina-scan

Would love to hear what patterns you're seeing in your AI-generated code. Drop them in the comments — if it's a real pattern we're not catching, we'll add it.

Top comments (0)