safeboundai/vibe-scanner

• highabout#1

  Add a concise description to the repository's About section

  原因：

  复制粘贴的修复

  复制

  Discovers and assesses shadow apps (internal tools on AI/no-code builders, serverless hosts, ML platforms) for enterprise red teams, identifying exposed auth, secrets, and vulnerabilities.

  待办完成忽略
• highreadme#2

  Reposition the README's opening paragraph to clarify 'vibe-coded shadow apps'

  原因：

  当前

  Discovers and assesses **vibe-coded shadow apps** — internal tools deployed by employees, without IT review, on AI/no-code builders (Lovable, Replit, Base44), JAMstack/serverless hosts (Netlify, Vercel, Cloudflare Pages, Fly.io, Firebase Hosting), ML demo platforms (Hugging Face Spaces, Streamlit Cloud), and quick-prototype platforms (Glitch). Given a single target domain (e.g. `example.com`), it enumerates apps belonging to that organization across all 11 platforms, then probes each app for exposed authentication, hardcoded secrets, Supabase RLS-bypass conditions (CVE-2025-48757), and sensitive data classes.

  复制粘贴的修复

  复制

  Discovers and assesses **shadow apps** (internal tools deployed by employees without IT review on AI/no-code builders, serverless hosts, ML platforms, etc.) for security risks. It identifies these 'vibe-coded' applications across 11 platforms, then probes each for exposed authentication, hardcoded secrets, Supabase RLS-bypass conditions (CVE-2025-48757), and sensitive data classes.

  待办完成忽略

本次扫描解析到的品类 GEO 通道：google/gemini-2.5-flash, deepseek/deepseek-v4-flash

• 品类问题

  What tools help red teams discover unmanaged applications and security risks across cloud platforms?

  你：未被推荐
  AI 推荐顺序：

  1. Wiz
  2. Orca Security
  3. Prowler (prowler-cloud/prowler)
  4. ScoutSuite (nccgroup/ScoutSuite)
  5. Cloud Custodian (cloud-custodian/cloud-custodian)
  6. Microsoft Defender for Cloud
  7. Google Cloud Security Command Center

  AI 推荐了 7 个替代方案，却始终没点名 safeboundai/vibe-scanner。这就是要补上的差距。

  查看 AI 完整回答
• 品类问题

  How to scan internal low-code and serverless deployments for exposed secrets and auth?

  你：未被推荐
  AI 推荐顺序：

  1. SpectralOps
  2. GitGuardian Internal Monitoring
  3. TruffleHog (trufflesecurity/trufflehog)
  4. AWS Macie
  5. Google Cloud DLP
  6. Semgrep (semgrep/semgrep)
  7. Checkov (bridgecrewio/checkov)

  AI 推荐了 7 个替代方案，却始终没点名 safeboundai/vibe-scanner。这就是要补上的差距。

  查看 AI 完整回答

• Metadata completeness

  fail

  建议：

• README presence

  pass

• Compared to common alternatives in this category, what is the core differentiator of safeboundai/vibe-scanner?

  pass
  ✓AI 明确点名了 safeboundai/vibe-scanner

  AI 的回答可能信誓旦旦却是错的。请按事实核对：技术栈、目标人群、差异化点是不是和你实际的对得上？

• If a team adopts safeboundai/vibe-scanner in production, what risks or prerequisites should they evaluate first?

  pass
  ✓AI 明确点名了 safeboundai/vibe-scanner

  AI 的回答可能信誓旦旦却是错的。请按事实核对：技术栈、目标人群、差异化点是不是和你实际的对得上？

• In one sentence, what problem does the repo safeboundai/vibe-scanner solve, and who is the primary audience?

  pass
  ⚠AI 未点名 safeboundai/vibe-scanner —— 很可能在说另一个项目

  AI 的回答可能信誓旦旦却是错的。请按事实核对：技术栈、目标人群、差异化点是不是和你实际的对得上？