VibeGuard

**Inspiration

Vibe-coded projects ship fast and ship insecure. Hardcoded credentials, unsanitized SQL, missing auth checks — the kind of thing that never shows up in a demo but is sitting in the repo the whole time. Existing scanners either drown you in false positives or cost more per scan than a hackathon budget allows. VibeGuard was built to catch the real issues cheaply, and then actually fix them instead of just filing a complaint.

**What it does

VibeGuard is a security vulnerability scanner and automated code-review tool with a three-stage pipeline:

Intake — Submit a public GitHub repository URL. VibeGuard validates it, clones it, and persists every file's contents to Postgres. You can also skip the repo entirely and submit a single code snippet as plain text for an immediate scan.
Scan — A hybrid heuristic-then-LLM pipeline checks stored files against 10 OWASP-aligned vulnerability categories. Cheap local pattern matching runs over every file first; only files that actually match get escalated to an LLM (DeepSeek V3.1 via OpenRouter) to confirm the finding and write remediation guidance. This two-stage design keeps token cost proportional to real signal instead of repo size.
Remediate — For any scanned repository, VibeGuard generates an LLM-proposed fix per findings-bearing file. You review the actual diff, and on approval it pushes the commit directly to the repository's default branch on GitHub via GitHub OAuth and the Contents API. The diff review at approval time is the safety net — nothing lands without a human looking at it.

The whole thing is exposed as a FastAPI REST API: POST /repositories, POST /repositories/{id}/scan, GET /repositories/{id}/findings, POST /repositories/{id}/remediate, POST /remediations/{id}/approve.

**How we built it API layer: FastAPI + Uvicorn, Python 3.12 Persistence: PostgreSQL via psycopg, schema managed with Alembic migrations Scanning: local heuristic pattern matching as a first-pass filter, then DeepSeek V3.1 through OpenRouter for confirmation and remediation text Auth & push: GitHub OAuth App for the remediation flow; OAuth tokens encrypted at rest with Fernet; commits pushed through the GitHub Contents API Architecture: ports-and-adapters layout (src/vibeguard/adapters/...), configuration entirely through

**VIBEGUARD environment variables Quality: pytest with pytest-postgresql spinning up ephemeral local Postgres instances per test run (no Docker required), Ruff for linting, mypy for type checking, MkDocs for the docs site

**Challenges we ran into

The remediation push flow was the hard part — writing to someone's default branch is genuinely dangerous, so the design had to make the diff review unavoidable rather than optional.

**Accomplishments that we're proud of

End-to-end pipeline: URL in, reviewed security fix committed to GitHub out Cost-aware scanning that scales with findings, not with repo size Tests that spin up their own throwaway Postgres — clone the repo and pytest just works Full documentation site alongside the code, not as an afterthought

**What we learned

Hybrid pipelines beat pure-LLM ones on both cost and precision when you can write a cheap filter for the first pass. And any tool that writes to a user's repository has to treat the approval step as a first-class part of the product, not a confirmation dialog bolted on at the end.

**What's next for VibeGuard Open a pull request instead of pushing directly to the default branch, so changes go through CI Support private repositories through the existing OAuth flow Broaden beyond the current 10 OWASP-aligned categories Background job queue so large-repository scans don't block the request Desktop, and IDE UI for easy interactions