VibeCop Documentation

Your codebase is
accumulating entropy.
We measure it.

Every PR gets reviewed against your codebase's established patterns — not just the diff. VibeCop catches architectural drift before it compounds into technical debt.

What VibeCop catches

AI Slop Detection — 6 surfaces

Before any LLM touches your code, six deterministic layers run across your entire repo. Fast, cheap, no false positives from hallucinated rules.

DEP SCAN

Dependency vulnerabilities — CVEs across your entire package tree, transitive included.

SECRETS

Exposed credentials — API keys, tokens, hardcoded passwords in source.

SAST

Static code patterns — Injection, XSS, path traversal via Semgrep rules.

IAC

Infrastructure misconfigs — Dockerfile, Terraform, k8s manifests.

VENDORED

Vendored-code drift — Copied third-party code that has drifted from its upstream source.

MAGIC

Magic numbers — Unexplained numeric literals that should be named constants.

$ vibecop scan --quick realworld-app
↳ 62 packages · 1,240 files
 
— dep scan ————————————————
  ✗ P1 lodash@4.17.20 CVE-2021-23337
  ✗ P1 express-jwt@5.3.1 auth bypass
— secrets ——————————————————
  ⚠ P2 JWT_SECRET config.js:4 (hardcoded)
— SAST (semgrep) ———————————
  ⚠ P2 sql-concat db/queries.js:88
— IaC ——————————————————————
  ⚠ P2 root-user Dockerfile:3
 
  3 critical · 7 warnings · done in 28s

Architecture Integrity Index

A score, not a report. 0–100. Updated per PR.

Computed across four structural axes — each worth 25 points. Tracks how coherent your codebase's architecture is over time. Not a linter. A health signal.

Consistency