Checks

What VibSec catches

Your AI agent writes fast, but it doesn't think about security. VibSec runs 30+ checks mapped to OWASP LLM Top 10 and ASVS 5.0 — here's everything it scans for and why it matters.

30+

Security Checks

Across 8 categories covering secrets, supply chain, injection, ports, and more

8/10

OWASP LLM Risks

Maps to the OWASP Top 10 for LLM Applications (2025)

Config Required

Works out of the box on any project — just run vibsec scan

Port Exposure

Exposed Ports

Detects databases and services listening on all network interfaces instead of localhost.

high ASVS V15.3.6

Secrets & Credentials

Hardcoded Secrets

Detects API keys, tokens, and credentials hardcoded in source files by AI agents.

critical LLM02

Supply Chain

Supply Chain Risks

Detects typosquatted packages, unpinned dependencies, and curl-pipe-bash patterns AI agents introduce.

high LLM03

Browser Security

Browser & Cookie Security

Detects insecure cookie settings, missing security attributes, and client-side vulnerabilities.

high ASVS V3.4

Safe Deserialization

Deserialization & Data Handling

Detects unsafe deserialization, YAML/pickle loading, and unvalidated data parsing.

critical ASVS V1.5

Excessive Agency

Detects overly permissive AI agent configurations and dangerous tool access patterns.

high LLM06

Injection Prevention

Detects SQL injection, command injection, and XSS patterns in AI-generated code.

critical ASVS V1.2

System Prompt Leakage

Detects AI system prompts and internal instructions exposed in public code.

high LLM07

Improper Output Handling

Unsafe Code Patterns

Detects eval(), exec(), and other dangerous patterns AI agents love to generate.

high LLM05