tanviet12/vbsec

What it solves

vbsec identifies security vulnerabilities in code generated by AI assistants. It specifically targets 21 common security flaws—such as SQL injection, hardcoded secrets, and broken access controls—that are frequently introduced by AI but often overlooked during manual review.

How it works

Unlike simple scanners that just look for specific patterns, vbsec performs data-flow analysis to understand how information moves through your code. It categorizes data into trust levels, flagging only instances where untrusted input (like from a URL or form) reaches a dangerous function without being properly cleaned. It supports Go, PHP, TypeScript/JavaScript, Python, and .NET, and can scale to large repositories by splitting the work across multiple parallel agents.

Who it’s for

It is designed for developers who use AI coding assistants and want a reliable, automated way to catch security bugs before they reach production. It is particularly useful for those who need clear, step-by-step explanations of why a piece of code is dangerous and how to fix it, regardless of their security expertise.

Highlights

• Scans code for 21 common vulnerability types, including injection, authentication flaws, and configuration errors.
• Provides actionable, plain-language explanations for every issue, including the original code and the recommended fix.
• Reduces false alarms by tracing data origins rather than just matching text patterns.
• Integrates directly with Claude Code, OpenAI Codex, and Google Antigravity.
• Generates reports in English or Vietnamese, with JSON summaries suitable for CI/CD pipelines.