feat: add dependency vulnerability scanning via OSV.dev API

[Codewithaiyan]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vibe-guard	Ready	Preview, Comment	May 30, 2026 7:50am

[github-actions]

VibeGuard Security Scan Results

Scan Type	File	Score	Risk Level
Code	backend/dependency_scanner.py	90/100	LOW
Code	backend/main.py	80/100	MEDIUM
Code	frontend/src/App.jsx	70/100	MEDIUM

Code Vulnerabilities

backend/main.py

• Exposed API keys (Line 18)
  Description: The application loads environment variables using dotenv, which may expose sensitive information if the .env file is not properly secured.
  Fix suggestion: Ensure that the .env file is not included in version control and restrict access to it.
• Missing input validation (Line 34)
  Description: The scan and scan_dependencies endpoints do not validate the content of the requests, which could lead to unexpected behavior or security issues.
  Fix suggestion: Implement input validation to ensure that the code and file content meet expected formats and constraints.
• CORS configuration (Line 27)
  Description: The CORS middleware is configured to allow all methods and headers, which may expose the API to cross-origin attacks.
  Fix suggestion: Restrict allowed methods and headers to only those necessary for the application.

frontend/src/App.jsx

• Exposed API URL (Line 1)
  Description: The API URL is hardcoded and can expose the backend service to unauthorized access if not properly secured.
  Fix suggestion: Use environment variables to manage sensitive configuration like API URLs.
• Missing Input Validation (Line 2)
  Description: User inputs for code and dependency content are not validated, which can lead to injection attacks.
  Fix suggestion: Implement input validation and sanitization for user inputs.
• Potential XSS (Line 3)
  Description: User-generated content is rendered directly without escaping, which may lead to XSS vulnerabilities.
  Fix suggestion: Escape user inputs before rendering them in the UI.

Dependency Vulnerabilities

No supported dependency files changed in this PR.

Dependency Scan Notes

No dependency scan notes because no supported dependency files changed.

---

Powered by VibeGuard