ubon/docs/README.md

Security scanner for AI-generated apps (Cursor, Lovable, Windsurf, v0). Catches hardcoded secrets, prompt injection, hallucinated imports, Server Actions / Edge runtime mistakes, and the vibe-coded vulnerabilities traditional linters miss.

# Ubon Docs

The pages below cover everything. Each is independent — start with the
one that matches what you need.

| Page                                 | When to read                                    |
| ------------------------------------ | ----------------------------------------------- |
| [START-HERE.md](./START-HERE.md)     | Two-minute setup and daily commands             |
| [AGENT-HARNESS.md](./AGENT-HARNESS.md) | Cursor, Claude Code, Codex, MCP, hooks, CI    |
| [AGENT-SEMANTICS.md](./AGENT-SEMANTICS.md) | How Ubon models agent workflows and gates |
| [PROGRAMMATIC.md](./PROGRAMMATIC.md) | Node API, JSON/NDJSON, and MCP contracts        |
| [CLI.md](./CLI.md)                   | Full command and flag reference                 |
| [RULES.md](./RULES.md)               | Glossary of all rule IDs (SEC*, AI*, NEXT*, …) |
| [CONFIG.md](./CONFIG.md)             | `ubon.config.json` schema                       |
| [INTEGRATIONS.md](./INTEGRATIONS.md) | Cursor + Lovable + comparison vs ESLint/audit   |
| [MCP.md](./MCP.md)                   | Run Ubon as a Model Context Protocol server     |
| [ADVANCED.md](./ADVANCED.md)         | Profiles, suppressions, baselines, output schemas, release policy |
| [RELEASE.md](./RELEASE.md)           | Release verification and publish checklist      |
| [VALIDATION.md](./VALIDATION.md)     | Dogfood, fixtures, contracts, and repair loops  |
| [SECURITY.md](./SECURITY.md)         | Reporting vulnerabilities                       |
| [schema/](./schema/)                 | JSON Schema for `--json` / `--ndjson` output    |

For quickstart, see the top-level [README](../README.md). For v3
breaking changes, see [MIGRATION-v3.md](../MIGRATION-v3.md).