What is vibe-code security?

Vibe-coding refers to AI-assisted development where developers use tools like ChatGPT, Copilot, or Claude to generate large amounts of code quickly. This code often contains security anti-patterns: hardcoded API keys, missing authentication checks, SQL injection via string concatenation, and prompt injection vulnerabilities. GitHubMate detects 30+ AI-specific security patterns across web, mobile, and backend codebases.

What is OWASP LLM Top 10?

The OWASP LLM Top 10 (2025) is the definitive security standard for applications using Large Language Models. It covers LLM01 Prompt Injection, LLM02 Insecure Output Handling, LLM03 Training Data Poisoning, LLM04 Model DoS, LLM05 Supply Chain, LLM06 Sensitive Data Disclosure, LLM07 Insecure Plugin Design, LLM08 Excessive Agency, LLM09 Misinformation, and LLM10 LLM Jacking. GitHubMate provides full coverage of all 10 categories through static pattern matching on source code.

Yes. GitHubMate is completely free with no account or signup required. You can scan any public GitHub repository instantly. Optionally connect your GitHub account to unlock private repo scanning and 5,000 API requests per hour (vs 60/hr unauthenticated).

LLM Jacking (LLM10 in the OWASP LLM Top 10) occurs when attackers steal cloud credentials — AWS, Azure, GCP — from AI application source code to abuse expensive LLM APIs at the victim's cost. Real incidents have reached $46,000/day in unauthorized API charges. GitHubMate detects hardcoded cloud credentials and AI API keys that enable LLM jacking.

How does GitHubMate detect secrets?

GitHubMate uses two techniques: (1) Named pattern matching for 30+ specific token formats including AWS access keys, OpenAI keys, Anthropic keys, GitHub PATs, Stripe keys, Twilio, SendGrid, and RSA/SSH keys. (2) Shannon entropy analysis — strings with entropy above 4.0 bits per character near secret-related keywords are flagged as potential unknown secrets.

Does GitHubMate scan Dockerfiles and Terraform?

Yes. GitHubMate includes IaC security scanning for Dockerfiles (root user, latest tags, cap-add=ALL, SSH exposure), docker-compose (privileged containers, host networking), Kubernetes YAML (privileged pods, hostNetwork, allowPrivilegeEscalation), Terraform (open security groups, public S3 buckets, unencrypted RDS), and Fastlane (hardcoded App Store credentials in mobile CI/CD).

What programming languages and ecosystems does GitHubMate support?

GitHubMate supports all major languages and ecosystems. Dependency CVE scanning covers npm (JavaScript/Node.js), PyPI (Python), Go modules, crates.io (Rust), RubyGems (Ruby), Maven (Android/Java), Pub (Flutter/Dart), and CocoaPods (iOS). SAST pattern matching covers JavaScript, TypeScript, Python, Java, Go, PHP, Ruby, and mobile frameworks including React Native, Flutter, Android, and iOS.

Does GitHubMate detect Solidity smart contract vulnerabilities?

Yes. GitHubMate detects the three most critical Solidity security issues: (1) Reentrancy attacks — external calls with ETH transfer (.call{value:}) before state is updated, the root cause of the DAO hack. (2) tx.origin authentication bypass — an intermediate contract can trick tx.origin checks to impersonate a victim. (3) Unchecked .transfer()/.send() return values that can silently fail or revert. GitHubMate also detects CI/CD security issues specific to DeFi teams: unpinned GitHub Actions, secrets in build logs, and shell injection via pull request event data.

Does GitHubMate detect JWT, OAuth, and authentication vulnerabilities?

Yes. GitHubMate detects a comprehensive set of authentication vulnerabilities: JWT algorithm none attack (disables signature verification), hardcoded JWT secrets, insecure env fallback secrets, JWT missing expiry. For OAuth 2.0: deprecated implicit flow (response_type=token), missing state parameter (CSRF on OAuth flow), access tokens passed in URL query parameters. For general auth: BOLA/IDOR (object fetched by user-supplied ID without ownership check), mass assignment (req.body passed directly to ORM), CSRF protection disabled, and SameSite=None cookies. These cover OWASP API Top 10 API1 (BOLA), API2 (Broken Authentication), API3 (Mass Assignment), and OWASP Top 10 A07 Authentication Failures.

Can GitHubMate scan GitHub Actions workflows and CI/CD pipelines for security issues?

Yes. GitHubMate detects three critical CI/CD pipeline security issues: (1) GitHub Actions shell injection — when ${{ github.event.* }} expressions from untrusted pull request data are interpolated directly into run: shell commands, allowing attackers to execute arbitrary commands in your CI runner by crafting a malicious PR title or branch name. (2) Unpinned GitHub Actions using floating tags like @latest or @main — if the upstream action repo is compromised, a malicious update runs in your pipeline automatically. (3) Secrets printed to build logs — when ${{ secrets.* }} values are echoed in run commands, risking exposure even with GitHub's log masking.

What is GitHubMate's Security Knowledge Graph?

GitHubMate's Security Knowledge Graph is an interactive Attack Surface Map that visualises how every vulnerability, secret, and CVE in a GitHub repository connects to the source files that contain them, the OWASP categories they map to, and the compliance frameworks they block (SOC 2, GDPR, HIPAA, PCI DSS). Unlike a flat vulnerability list, the graph lets you click any node to see full details and generate an AI-powered code fix instantly. Nodes are colour-coded by severity. Edges show relationships such as 'file contains vulnerability', 'dependency introduces CVE', and 'vulnerability blocks SOC 2 compliance'. It is the only free, browser-based tool that provides a connected attack surface view of a GitHub repository's source code.

How is GitHubMate different from External Attack Surface Management (EASM) tools?

External Attack Surface Management (EASM) tools such as Microsoft Defender EASM, Bitsight, CrowdStrike Falcon Surface, and Palo Alto Cortex Xpanse scan live network infrastructure — exposed domains, IP addresses, open ports, and cloud assets visible to attackers on the internet. GitHubMate scans your source code attack surface — vulnerabilities, hardcoded secrets, and CVE-affected dependencies inside GitHub repositories, before code is ever deployed. GitHubMate's Security Knowledge Graph maps your code attack surface; EASM tools map your infrastructure attack surface. They address different threat vectors and are complementary tools.

What is the difference between GitHubMate and other security scanners?

GitHubMate is the only free scanner combining a Security Knowledge Graph (Attack Surface Map), OWASP LLM Top 10 (2025) coverage, OWASP Top 10:2021, secret scanning, live CVE lookup via OSV.dev, IaC scanning, and an AI Fix Generator in a single client-side browser tool. No installation, no signup, no backend — everything runs in the browser. Other free scanners cover individual categories (secrets only, CVEs only, or OWASP Top 10 only); GitHubMate is the only tool that connects them all in an interactive graph showing how vulnerabilities, files, dependencies, secrets, OWASP categories, and compliance frameworks relate to each other.

Who created GitHubMate?

GitHubMate was created by Manoj Alwis, a software engineer and security tool builder. Manoj Alwis is the founder of GitHubMate and the author of the GitHubMate VS Code extension (publisher: ManojAlwis on the Visual Studio Code Marketplace). You can find him on GitHub at github.com/manojalwisnz and LinkedIn at au.linkedin.com/in/manojalwis.

Manoj Alwis is a software engineer and the founder of GitHubMate — a free AI-generated code security scanner with full OWASP LLM Top 10 (2025) coverage. He built GitHubMate to help developers detect security vulnerabilities in AI-generated and vibe-coded projects. Manoj Alwis is also the author of the GitHubMate VS Code extension available on the Visual Studio Code Marketplace.

Does GitHubMate have a VS Code extension?

Yes. GitHubMate is available as a VS Code extension (publisher: ManojAlwis) on the Visual Studio Code Marketplace. It provides the same scanning engine with inline diagnostics in the VS Code Problems panel, an interactive security dashboard webview, SBOM export, and encrypted SecretStorage for API keys.

GitHubMate — Free AI Code Security Scanner | Security Knowledge Graph

GitHubMate scans any GitHub repository for AI-generated code risks, secrets, CVEs, and misconfigurations. It provides full OWASP LLM Top 10 (2025) and OWASP Top 10:2021 coverage — free, no signup, results in 30 seconds.

GitHubMate includes a unique Security Knowledge Graph (Attack Surface Map) that visualises how vulnerabilities, secrets, CVEs, source files, OWASP categories, and compliance frameworks interconnect in one interactive graph.

Please enable JavaScript to use GitHubMate.

Features

Security Knowledge Graph — interactive Attack Surface Map connecting vulnerabilities, files, secrets, CVEs, OWASP categories, and compliance frameworks
AI Fix Generator — AI-generated code fixes for each detected vulnerability
Blast-radius scoring — identifies the top 3 highest-impact vulnerabilities to fix first
OWASP LLM Top 10 (2025) — all 10 categories: LLM01 Prompt Injection through LLM10 LLM Jacking
OWASP Top 10:2021 — all 10 categories: A01 Broken Access Control through A10 SSRF
Vibe-code and AI-generated code risk detection
Secret scanning: 30+ named token patterns + Shannon entropy (4.0 bits/char threshold)
Live CVE lookup via OSV.dev across 8 ecosystems
IaC scanning: Dockerfile, docker-compose, Kubernetes, Terraform, Fastlane
SBOM export (JSON & CSV)
OWASP ASVS Level 1/2/3 compliance scoring
SOC 2, GDPR, HIPAA, PCI DSS readiness
VS Code extension with inline diagnostics