vbsec

vbsec is a security scanning skill that reads a codebase and looks for the most common vulnerabilities found in AI-generated code, such as hardcoded passwords, SQL injection, broken access control, JWTs accepted without signature verification, and overly permissive CORS. For each issue it explains why it is dangerous, how an attacker could exploit it step by step, shows the current code, and suggests a fix.

Instead of matching text patterns, it traces how data flows from user input to the dangerous call, which the project says produces far fewer false positives than pattern-based scanners. It analyzes five languages in depth, Go, PHP, TypeScript/JavaScript, Python, and .NET/C#, including popular frameworks such as Express, NestJS, Next.js, React, Django, FastAPI, Laravel, and ASP.NET Core, and can scan a whole repository, only uncommitted changes, a single commit or pull request, or a range of recent commits. On large repositories it splits the work across several agents running in parallel and merges the results, and it can produce reports in English or Vietnamese, including a JSON summary for CI/CD.