Vibe Coding: AI Code Security Badge for GitHub Repos
The AI security badge is a free A–F security grade for GitHub repos, computed by real static analysis. One line in your README shows the world your repo's AI code security grade — A through F, from a real static-analysis scan. Secrets, injection flaws, XSS, CI/CD pipeline risks. Free, no signup.
Live examples
Real badges on real open-source repos, scanned October 2026:
ghostaction-guard-action
vibecode-scanner
domainguard-impersonation-spotcheck
cve-digest
prompt-injection-evals
cve-to-checker
cve-2026-110447-checker
ai-disclosure-checker
homelab-security-scoreAdd the badge to your README
Copy this into the top of your README (Markdown):
[](https://ingeniousai-security-checks.netlify.app/ai-security-badge.html)
The badge image links here, where visitors see what the grade means and how it was earned.
Get your repo scored
Run a free scan of any public repo, then claim your badge:
Scan my repo free More free security checksWhat is vibe coding?
Vibe coding is building software by describing what you want to an AI tool and letting it write the code, a term coined by Andrej Karpathy in 2025. It ships fast, which is exactly why the output needs a security grade before it needs users.
Vibe coding: frequently asked questions
It is a small image you embed in your README that shows a letter grade, A through F, for your repository’s code security. The grade comes from a real static-analysis scan that checks for hardcoded secrets, injection flaws, cross-site scripting and CI/CD pipeline risks. Every repo starts at 100 points and findings subtract from there — 90 or above earns an A.
What does the scanner check?
Hardcoded secrets and API keys, SQL injection patterns, XSS sinks, dangerous functions (eval, exec, shell calls), insecure deserialization, and CI/CD pipeline risks — including malicious workflow injection in the style of the October 2026 GhostAction supply-chain campaign.
How is the score calculated?
Every repo starts at 100. Critical findings subtract 25, high 10, medium 4, low 1. 90+ is an A, 75+ a B, 50+ a C, 25+ a D, below that an F. Test fixtures, docs, and example files are excluded — only shipped code counts.
Is it really free?
Yes. The badge, the scan behind it, and the report page are all free with no signup. It's built by Ingenious AI, the team behind Vibe-Code Audit.
Can the badge improve my project's trust?
That's the point. A visible, independently-computed security grade answers the first question every evaluator asks: "is this safe to depend on?" Link it next to your build-status badge.
How do I scan AI-generated code for vulnerabilities?
Run a static-analysis (SAST) scanner over the repo — open-source options include Semgrep and vibe-code-focused AI code security scanners — plus a secrets scan for hardcoded API keys, then a dynamic (DAST) scan against the running app. No scanner replaces a human review of authentication, data handling, and business logic.
What is vibe coding security?
Vibe coding security is the practice of checking AI-generated code for the flaws models commonly introduce: hardcoded secrets, injection flaws, cross-site scripting, disabled TLS verification, and insecure defaults. Research (Veracode's 2025 GenAI Code Security Report) found 45% of AI-generated code shipped a real vulnerability.
What are the best AI code security scanners?
Open-source AI code security scanners include vibescan, isitsecure, and AXguard, plus Cloudflare's security-audit-skill and general tools like Semgrep for static analysis and OWASP ZAP for dynamic testing. The right pick depends on your stack: SAST for code, DAST for running apps, secrets scanners for leaked keys.
Methodology: static analysis of shipped production code (October 2026 scan). Grades reflect the code as scanned; rescan after significant changes. A badge is a signal, not a certification.