The latest articles on DEV Community by lbcdsg (@3196973848). https://dev.to/3196973848 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4052735%2F489a3358-875a-461a-90b8-0a2fd544e6ff.png https://dev.to/3196973848 en lbcdsg Thu, 30 Jul 2026 05:15:06 +0000 https://dev.to/3196973848/i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects-4cd0 https://dev.to/3196973848/i-built-a-small-open-source-scanner-for-api-key-mistakes-in-vibe-coded-projects-4cd0 <p>I started this project because vibe coding makes it possible to get an app<br> working before a beginner has learned how secrets, frontend bundles, or Git<br> history behave.</p> <p>A value being in <code>.env</code> does not always mean it stays private. Variables such<br> as <code>VITE_*</code>, <code>NEXT_PUBLIC_*</code>, and <code>REACT_APP_*</code> can reach browser code. And if<br> an API key was committed, deleting it from the current file does not remove it<br> from Git history.</p> <p>So I built <strong>Wardrail</strong>, a small open-source safety check:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>npx wardrail scan <span class="nt">--history</span> </code></pre> </div> <p>It scans the current project and a bounded part of Git history. It also checks<br> MCP configuration and Agent instruction files for risky commands, credential<br> access, and safety-bypass patterns.</p> <p>Wardrail runs locally by default. It does not upload source code and does not<br> execute the project being scanned.</p> <h2> What the current version includes </h2> <ul> <li><code>wardrail@0.3.0</code></li> <li>17 explainable static rules</li> <li>38 automated tests</li> <li>Terminal, JSON, and SARIF output</li> <li>Pre-commit and GitHub Code Scanning support</li> </ul> <h2> Why I think this matters for beginners </h2> <p>AI coding tools can help someone ship a useful application very quickly. But<br> speed can hide security assumptions:</p> <ul> <li> <code>.env</code> is treated as automatically private</li> <li>Public frontend variables are mistaken for server-side secrets</li> <li>A deleted key is assumed to be gone from Git history</li> <li>A third-party MCP server or Agent Skill is trusted without reading its commands</li> </ul> <p>Wardrail is meant to be an early warning before a push or release. It explains<br> the matched evidence and suggests a fix instead of returning only a risk<br> score.</p> <h2> Honest limitations </h2> <p>This is still an early project, and I do not have external users to point to<br> yet. It can produce false positives and miss risks. It is not a penetration<br> test, and a clean report does not mean an application is secure.</p> <p>It does not currently test authentication, authorization, database policies,<br> dependency vulnerabilities, deployment settings, or runtime behavior.<br> Gitleaks and TruffleHog are still mature choices for broader secret discovery.</p> <h2> I am looking for the first real testers </h2> <p>Repository and CLI demo:</p> <p><a href="https://github.com/3196973848/wardrail" rel="noopener noreferrer">https://github.com/3196973848/wardrail</a></p> <p>The feedback that would help most is:</p> <ul> <li>Which rule was noisy or confusing?</li> <li>Which secret format or risky pattern did it miss?</li> <li>Was the suggested fix understandable to a beginner?</li> <li>Which MCP or Agent configuration should it support next?</li> </ul> <p>Please share only a rule ID and a redacted example—never post a live<br> credential. If a real key may have been exposed, revoke or rotate it first.</p> <p>Even a short report about what failed is more useful to me than a polite<br> "looks cool."</p> opensource security ai beginners