I Built a Code Security Scanner Called SecureVibe. I'd Love Your Feedback.

Hey everyone!

I've been working on a project called SecureVibe over the past few months.

The idea came from something I've been noticing: we're shipping software faster than ever, but security doesn't always keep up with development.

So I started building SecureVibe, a code security scanner that aims to help developers find vulnerabilities and understand whether they're actually exploitable.

It's currently an MVP, and there's still a lot of work to do, but I wanted to share it and get some feedback from other developers and security engineers.

Here's what it currently does:

1. Vulnerability Detection: Scans your codebase and shows detected vulnerabilities with relevant code snippets and locations.

2. AI-Powered Fixes: An optional AI fixing feature. For now, you can use your own API key.

3. Ask the Graph: You can ask questions about your codebase, such as where an attacker could potentially exploit your application or whether there are authentication-related security issues.

4. Filtering & Reports: Filter vulnerabilities by categories such as CWE, database injection, and more. You can also download an interactive HTML report to review findings and work on fixing them later.

5. Attack Path Analysis: This is one of the parts I've spent quite some time on. Rather than simply scanning code and reporting issues, SecureVibe uses Tree-sitter and AST analysis to understand code context and build a graph connecting application routes, handlers, and database calls. This helps determine whether findings are actually reachable and classify them as Confirmed or Likely.

Some validation I've done:

One of the challenges I faced was finding reliable benchmarks to validate the security rules and measure detection accuracy.

After some research, I started using the OpenSSF CVE benchmark. SecureVibe achieved a raw F1 score of 77.5 and an adjusted F1 score of 81.7.

However, I'm still working on reducing false positives and improving detection accuracy. There's definitely room for improvement.

What I'd really appreciate help with:

• If you try it, did you encounter any false positives or missed vulnerabilities?
• Did you run into any issues while scanning your repository?
• Were the findings and attack paths actually useful?
• Is there anything you'd expect from a tool like this that is currently missing?

It's still an MVP, and I'm looking for honest feedback to help decide what to improve in the next development phases.

The scanner currently works best with TypeScript repositories, so I'd recommend starting there.

You can try it here:

https://securevibe-dev.vercel.app/

I'd genuinely appreciate anyone willing to give it a try.

Thanks!