# Ybe Check 🛡️

**Ybe Check** is a production-ready security and compliance orchestrator designed specifically for "vibe-coded" (AI-generated) repositories. It scans your codebase for security vulnerabilities, PII leaks, compliance issues, and production readiness.

[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
[![Node 18+](https://img.shields.io/badge/node-18+-green.svg)](https://nodejs.org/)

---

## 🚀 Overview

In the age of AI-assisted development, code is generated faster than it can be audited. Ybe Check bridges this gap by providing an automated, multi-layered scanning suite that covers everything from static analysis to dynamic live probing.

## 🛠️ Core Modules (The 17 Pillars)

Ybe Check orchestrates **17 specialized modules** across three categories:

### 1. Static Analysis (Pip Install Ready)
- **Secrets**: `detect-secrets` scan for leaked keys.
- **Prompt Injection**: `vigil` analysis for prompt-based vulnerabilities.
- **Dependencies**: `pip-audit` for insecure package versions.
- **PII Compliance**: Regex-based PII detection + `PRIVACY.md` validation.
- **Logging Security**: Detection of PII leaks in log patterns.
- **Auth Guards**: AST parsing to ensure API routes are protected.
- **IaC Security**: `checkov` for infrastructure-as-code misconfigurations.
- **License Compliance**: `fossa` analysis for legal risk.
- **Test Coverage**: Integrated coverage reporting.
- **AI Traceability**: Identification of "Generated by" AI markers.

### 2. Dynamic Analysis (Local Probing)
- **Load Testing**: `artillery` performance benchmarks.
- **Web Attacks**: `owasp/zap` Docker-based vulnerability scanning.
- **API Fuzzing**: `ffuf` endpoint discovery and stress testing.
- **Prompt Live**: Direct interaction testing with LLM endpoints via `vigil`.

### 3. Infrastructure & Distribution
- **Container Scan**: `trivy` image auditing.
- **SBOM**: `syft` Software Bill of Materials generation.
- **Config & Env**: `.env.example` validation and comparison.

---

## 💻 Installation

### CLI (Python)
```bash
pip install ybe-check[all]
```

### Dynamic Scanning Tools (Node.js)
```bash
npm i -g artillery @fossa/cli
```

### Optional Docker Tools
```bash
docker pull owasp/zap2docker-stable
docker pull aquasec/trivy
docker pull anchore/syft
```

---

## 📝 Usage

Run a full audit on your workspace:
```bash
python -m ybe_audit . --json
```

### CLI Output Format
Ybe Check generates a comprehensive `report.json`:
```json
{
  "ybe_to_value": 78,
  "docker_detected": true,
  "go_no_go": "CONDITIONAL_GO",
  "modules": [
    {"name": "secrets", "score": 95, "issues": 1},
    {"name": "dependencies", "score": 100, "issues": 0}
  ]
}
```

---

## 🔌 VS Code Extension

The Ybe Check extension integrates the CLI directly into your development workflow:
- ✅ **Status Bar**: Real-time "Ybe-to-Value" score.
- ✅ **Command Palette**: Run Static or Full audits.
- ✅ **Problems Panel**: In-line security issue highlighting.
- ✅ **Sidebar Webview**: Detailed breakdown of module scores and suggested fixes.

---

## 🗺️ Roadmap
- [x] CLI Orchestrator Core
- [x] Module 1: Secrets Detection
- [ ] Module 2: Prompt Injection Detection (Vigil)
- [ ] Extension UI Integration
- [ ] Docker Hybrid Mode

## 📄 License
This project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.
