ubon
Version:
Security scanner for AI-generated apps (Cursor, Lovable, Windsurf, v0). Catches hardcoded secrets, prompt injection, hallucinated imports, Server Actions / Edge runtime mistakes, and the vibe-coded vulnerabilities traditional linters miss.
17 lines • 695 B
TypeScript
import { Rule } from '../types';
/**
* AI001: LLM provider API key hardcoded.
*
* Catches OpenAI, Anthropic, Google AI Studio / Gemini, Cohere, Mistral,
* Groq, Together, Perplexity and Replicate keys when they appear inline
* in source code or `.env` files (which is fine if `.env` is gitignored,
* but ENV001/ENV002 cover that orthogonally).
*
* Why a dedicated rule (vs SEC001/SEC014): AI providers ship with their own
* key prefixes, fast key-rotation flows, and free-tier abuse vectors that
* deserve a focused fingerprint. A leaked AI key burns budget within
* minutes once it hits the wild.
*/
declare const rule: Rule;
export default rule;
//# sourceMappingURL=AI001.d.ts.map