Security scanner for vibe-coded projects - Claude Code extension
npm install goodvibesonly-cc```
╔═════════════════════════════════════════════════════════════════╗
║ ║
║ ░██████╗░██╗░░░██╗░█████╗░ ║
║ ██╔════╝░██║░░░██║██╔══██╗ ║
║ ██║░░██╗░╚██╗░██╔╝██║░░██║ ║
║ ██║░░╚██╗░╚████╔╝░██║░░██║ ║
║ ╚██████╔╝░░╚██╔╝░░╚█████╔╝ ║
║ ░╚═════╝░░░░╚═╝░░░░╚════╝░ ║
║ ║
║ 🛡️ security scanner for vibe coders 🛡️ ║
║ ║
╚═════════════════════════════════════════════════════════════════╝
Security scanner for vibe-coded projects. A Claude Code extension that automatically scans for vulnerabilities when Claude Code commits on your behalf.
GoodVibesOnly uses Claude Code's hooks system to intercept git commands within Claude Code sessions. It does not hook into git directly — it only triggers when Claude Code itself runs a Bash command.
1. Intercepts Claude Code's Bash calls - A PreToolUse hook runs the scanner whenever Claude Code is about to execute a Bash commandgit commit
2. Checks for git commit/push - If the command is a or git push, it scans staged files for hardcoded secrets, injection vulnerabilities, XSS, and more
3. Blocks on critical issues - Prevents Claude Code from executing the commit by exiting with code 2
4. Allows warnings through - High/medium issues are reported but don't block
> Note: This only works when committing through Claude Code. Running git commit directly in your terminal will not trigger the scan. For terminal-level git hooks, consider a traditional pre-commit hook tool.
`
You (in Claude Code): commit my changes
🛡️ GoodVibesOnly Security Scan
🔴 CRITICAL - Must fix before commit:
1. Hardcoded API Key
src/config.js:15
const API_KEY = "sk-abc123..."
2. SQL Injection
src/db/users.js:42
db.query("SELECT * FROM users WHERE id = " + id)
Found 2 critical, 0 high, 0 medium issues.
Commit blocked — fix critical issues before committing.
`
`bash`
npx skills add jddoesdev/goodvibesonly
Or install globally:
`bash`
npx skills add jddoesdev/goodvibesonly --global
`bash`
npx goodvibesonly-cc
`bash`
npm install -g goodvibesonly-cc
`bash`
git clone https://github.com/jddoesdev/goodvibesonly.git
cd goodvibesonly
node bin/install.js --global
`bash`
node bin/install.js --global # Install to ~/.claude/ (all projects)
node bin/install.js --local # Install to ./.claude/ (this project)
node bin/install.js --no-hooks # Skip hook installation (command/skill only)
node bin/install.js --uninstall # Remove GoodVibesOnly
When working inside Claude Code, GoodVibesOnly runs automatically whenever Claude executes a git commit or push:
``
You: commit my changes # Scans before Claude runs git commit
You: push to origin # Scans before Claude runs git push
``
/goodvibesonly
Or ask Claude:
``
is this code safe?
goodvibesonly this
check for security issues
| Category | Examples |
|----------|----------|
| API Keys | OpenAI (sk-...), Anthropic (sk-ant-...), AWS (AKIA...), GitHub (ghp_...), Stripe (sk_live_...) |origin: "*"
| Secrets | Hardcoded passwords, API keys, private keys |
| Injection | SQL injection, command injection, code injection (eval) |
| Config | CORS wildcard (), disabled SSL verification |
| Category | Examples |
|----------|----------|
| XSS | innerHTML, dangerouslySetInnerHTML, v-html |pickle.loads()
| Deserialization | , yaml.load() without SafeLoader |
| Weak Crypto | MD5/SHA1 for passwords |
| Category | Examples |
|----------|----------|
| Debug | DEBUG = true |console.log(password)
| Logging | |
| TODOs | Security-related TODOs |
| HTTP | Non-HTTPS URLs |
``
goodvibesonly/
├── bin/
│ ├── install.js # Installer (copies files + sets up hooks)
│ └── scan.js # Scanner script (runs via hooks)
├── commands/
│ └── goodvibesonly.md # /goodvibesonly slash command
├── skills/
│ └── goodvibesonly/
│ └── SKILL.md # Skill for Claude assistance
├── hooks/
│ └── hooks.json # Hook configuration template
├── package.json
└── README.md
Suppress specific findings by adding a .goodvibesonly.json file to your project root:
`json`
{
"allow": [
{ "pattern": "XSS via dangerouslySetInnerHTML", "reason": "Sanitized with DOMPurify" },
{ "path": "test/**", "reason": "Test files contain intentional patterns" },
{ "pattern": "SQL Injection", "path": "src/db/raw.js", "reason": "Parameterized at call site" }
]
}
Each entry in the allow array supports:
| Fields | Effect |
|--------|--------|
| pattern only | Suppress that pattern in all files |path
| only | Suppress all patterns in matching files |pattern
| + path | Suppress specific pattern in specific files |
- reason is expected on every entry (warns if missing)node bin/scan.js --list-patterns
- Pattern names must match exactly — run to see all namespath
- supports glob patterns ( for single directory, * for recursive)
When GoodVibesOnly flags a finding in Claude Code, you can tell Claude to allow it:
``
You: allow the dangerouslySetInnerHTML one
Claude: One-time (this commit only) or permanent?
You: permanent
Claude: What's the reason?
You: sanitized with DOMPurify
- One-time: temporarily adds the entry, commits, then removes it
- Permanent: adds the entry to .goodvibesonly.json for you to commit later
`bash`
node bin/scan.js --list-patterns
- Actually enforces - Uses Claude Code's PreToolUse hooks to block commits, not just advisory
- Real scanning - Node.js script with regex patterns, not just instructions for Claude
- Zero config - Installs hooks automatically into Claude Code's settings
- Uninstall support - Clean removal with --uninstall
GoodVibesOnly installs a PreToolUse hook in Claude Code's settings. This hook runs before every Bash tool call that Claude Code makes. When the scanner detects the command is a git commit or git push:
1. Reads staged files via git diff --cached --name-only
2. Scans each file against vulnerability patterns
3. Outputs findings to stderr
4. Exits with code 2 to block Claude Code from running the command (critical issues) or 0 to allow it
For non-git commands, the scanner exits immediately with code 0 (allow).
The hook is configured in Claude Code's settings.json:
`json`
{
"hooks": {
"PreToolUse": [{
"matcher": "Bash",
"hooks": [{
"type": "command",
"command": "node \"~/.claude/goodvibesonly/scan.js\""
}]
}]
}
}
`bash`
node bin/install.js --uninstall --globalor
node bin/install.js --uninstall --local
Or manually:
`bash``
rm -rf ~/.claude/commands/goodvibesonly.md
rm -rf ~/.claude/skills/goodvibesonly/
rm -rf ~/.claude/goodvibesonly/Then remove the hook from ~/.claude/settings.json
MIT