Question 1

What is vibe-code security?

Accepted Answer

Vibe-coding refers to AI-assisted development where developers use tools like ChatGPT, Copilot, or Claude to generate large amounts of code quickly. This code often contains security anti-patterns: hardcoded API keys, missing authentication checks, SQL injection via string concatenation, and prompt injection vulnerabilities. GitHubMate detects 31 AI-specific security patterns.

Question 2

What is OWASP LLM Top 10?

Accepted Answer

The OWASP LLM Top 10 (2025) is the definitive security standard for applications using Large Language Models. It covers LLM01 Prompt Injection, LLM02 Insecure Output Handling, LLM03 Training Data Poisoning, LLM04 Model DoS, LLM05 Supply Chain, LLM06 Sensitive Data Disclosure, LLM07 Insecure Plugin Design, LLM08 Excessive Agency, LLM09 Misinformation, and LLM10 LLM Jacking. GitHubMate provides full coverage of all 10 categories.

Question 3

Is GitHubMate free?

Accepted Answer

Yes. GitHubMate is completely free with no account or signup required. You can scan any public GitHub repository instantly. Optionally connect your GitHub account to unlock private repo scanning and higher API rate limits.

Question 4

What is LLM jacking?

Accepted Answer

LLM Jacking (LLM10 in the OWASP LLM Top 10) occurs when attackers steal cloud credentials — AWS, Azure, GCP — from AI application source code to abuse expensive LLM APIs at the victim's cost. Real incidents have reached $46,000/day in unauthorized API charges. GitHubMate detects hardcoded cloud credentials and AI API keys that enable LLM jacking.

Question 5

How does GitHubMate detect secrets?

Accepted Answer

GitHubMate uses two techniques: (1) Named pattern matching for 30+ specific token formats including AWS access keys, OpenAI keys, Anthropic keys, GitHub PATs, Stripe keys, and more. (2) Shannon entropy analysis — strings with entropy above 4.0 bits per character near secret keywords are flagged as potential unknown secrets.

Question 6

Does GitHubMate scan Dockerfiles and Terraform?

Accepted Answer

Yes. GitHubMate includes IaC security scanning for Dockerfiles (root user, latest tags, cap-add=ALL, SSH exposure), docker-compose (privileged containers, host networking), Kubernetes YAML (privileged pods, hostNetwork, allowPrivilegeEscalation), and Terraform (open security groups, public S3 buckets, unencrypted RDS, publicly accessible databases).