VibeClean AI

AI-powered static analysis tool that detects security vulnerabilities, performance issues, and code quality problems in AI-generated code.

VibeClean combines AST-based pattern matching with LLM analysis (Claude, GPT-4) to catch issues that traditional linters miss — particularly in "vibe-coded" projects where AI-generated code often introduces subtle security flaws.

Security detection includes:

• SQL injection, XSS, insecure storage (OWASP Top 10)
• Missing authentication/authorization checks
• Insecure cryptographic patterns
• Framework-specific vulnerabilities (Spring Boot, ASP.NET Core)

Also detects:

• Performance issues (O(n^2) algorithms, memory leaks, blocking operations)
• Missing error handling, null checks, input validation
• Untestable code patterns

Frontend (React/Vite/TypeScript)
    |
  Nginx reverse proxy
    |
Backend (Express/TypeScript)
  ├── AST Analyzer (Babel, java-parser, tree-sitter)
  ├── AI Services (Claude Sonnet 4)
  ├── ARIA Integration (LLM security, informed by red-team findings)
  ├── Prompt Injection Detector (direct/indirect injection patterns)
  ├── Custom Rule Engine (YAML-based)
  ├── Redis cache (L1 in-memory, L2 Redis, L3 DB)
  └── PostgreSQL (Prisma ORM)

Additional interfaces: CLI tool, VS Code extension.

git clone https://github.com/rtj1/vibeclean-ai.git
cd vibeclean-ai

# Copy and edit environment config
cp backend/.env.example backend/.env
# Add your ANTHROPIC_API_KEY and OPENAI_API_KEY

# Docker (recommended)
docker-compose up -d

# Or manual
cd backend && npm install && npx prisma generate && npx prisma migrate dev && npm run dev
cd ../frontend && npm install && npm run dev

• Frontend: http://localhost:3000
• API: http://localhost:3001
• Health: http://localhost:3001/health

# Register + login
curl -X POST http://localhost:3001/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","password":"securepass123"}'

# Analyze code
curl -X POST http://localhost:3001/api/analysis/analyze \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"code": "const q = \"SELECT * FROM users WHERE id=\" + req.params.id", "language": "javascript"}'

Define team-specific detection rules in YAML:

name: no-eval
severity: critical
pattern: "eval\\("
message: "eval() is a code injection risk"
languages: [javascript, typescript]

Rules can be imported/exported and toggled per-project via the API.

vibeclean-ai/
├── backend/           # Express + TypeScript API
│   ├── src/
│   │   ├── services/  # AI, AST, ARIA integration, prompt injection detection
│   │   ├── routes/    # Auth, analysis, rules, user
│   │   ├── middleware/ # Auth, rate limiting, errors
│   │   └── __tests__/ # Jest test suite
│   └── prisma/        # Database schema
├── frontend/          # React + Vite + Tailwind
├── cli/               # Command-line interface
├── vscode-extension/  # VS Code integration
└── docker-compose.yml

• JWT authentication with API key support (SHA-256 hashed)
• Rate limiting (free: 100/15min, pro: 1000/15min)
• Helmet.js headers, CORS, input validation (Joi)
• SQL injection prevention via Prisma ORM
• Audit logging for all operations

This project focuses on the defensive side of AI code security. For offensive security research (LLM red-teaming), see ARIA — an automated red-teaming agent that systematically tests LLM safety mechanisms.

MIT

GitHub: @rtj1