vibegate
Host-agnostic pre-write security hook for coding agent: detects user-input patterns via Semgrep and emits deterministic, no-LLM security guidance.
A pre-write security scanner that checks code an AI coding assistant is about to save, blocking dangerous patterns like SQL injection before they reach disk.
VibeGate is a security checkpoint that sits between an AI coding assistant, like Claude Code or Codex, and your files. AI assistants write code quickly, and that code sometimes handles sensitive things like passwords, emails, API keys, or raw user input without thinking carefully about safety. VibeGate watches every file the assistant tries to write or edit, scans the new code using a tool called Semgrep, and decides whether it is safe to save.
It checks for a long list of known problems: things like command injection, SQL injection, path traversal, cross site scripting, insecure file uploads, and unsafe handling of secrets such as passwords and API keys. Some of these, the ones considered the most dangerous, cause the file to be blocked from saving entirely, and the assistant is told exactly why so it can fix the problem. Others, considered lower risk, still let the file save but print a warning explaining what was found and how to fix it. Every warning also comes with an instruction telling the assistant to mention the issue out loud in its reply, rather than quietly fixing it without telling you.
Importantly, no AI model is used to do this scanning. It relies entirely on fast, deterministic static analysis, meaning the results are consistent and do not use any extra AI usage or cost. If VibeGate itself runs into an unexpected error, it lets the file save anyway, so a bug in the tool never becomes the reason your work gets blocked.
VibeGate currently understands Python, JavaScript, TypeScript, Go, Java, PHP, and Ruby, and plugs into Claude Code and Codex. It can also check GitHub Actions workflow files for two common supply chain mistakes: using a movable version tag instead of a fixed commit, and using an unsafe trigger type. The project is released under the MIT License.
Where it fits
- Automatically block AI generated code that contains SQL injection or command injection before it is saved.
- Get a terminal warning when an AI assistant writes code that handles passwords or API keys unsafely.
- Check GitHub Actions workflows for unpinned actions and unsafe trigger types.