Original Summary

Hey everyone! I've been working on a small open-source project called SafePush . With tools like Cursor, Claude Code, and other AI coding assistants, it's becoming incredibly easy to build and deploy applications. But I think there's a problem we don't talk about enough: shipping code you don't fully understand, especially when it comes to security. It's surprisingly easy to accidentally commit an API key, expose a sensitive environment variable, or push a .env file. So I decided to build something to help catch those mistakes. SafePush is a free, local-first CLI that currently: Detects several common API key and token patterns. Flags potentially sensitive NEXT_PUBLIC_ and VITE_ variables. Warns when .env files are tracked by Git. Scans staged changes before committing. Explains findings and suggests how to fix them. Everything runs locally. No accounts, subscriptions, telemetry, or uploading your code. I've also been experimenting with ideas from recent cybersecurity research on arXiv, particularly evidence-based vulnerability detection and context-aware prioritization. The next update adds explanations of what evidence triggered a warning and prioritizes findings based on context. That update is currently in a pull request, with CI passing. GitHub: https://github.com/Danchikkl/SafePush If you'd like to try it, there's a synthetic demo: git clone https://github.com/Danchikkl/SafePush.git cd SafePush npm ci --ignore-scripts npm run demo It requires Node.js 22+. A quick disclaimer: this is still an experimental v0.1 project. Detection is heuristic, false positives and missed secrets are possible, and it isn't a replacement for established security tools or a proper security audit. It's also not published to npm yet. I'm especially interested in feedback from people who use AI coding assistants or work with Next.js and Vite. What security mistakes do you think AI-assisted developers are most likely to miss? And if anyone wants to contribute, I've opened a few beginner-friendly issues. Contributions and critical feedback are very welcome!   submitted by   /u/Danch___ [link]   [comments]

  • 情报分类：商业与市场研究
  • 分类依据：内容涉及商业、投资或市场动态
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/10/14 12:45:51