Documentation

Learn how to use GlanceVibe CLI to secure your JavaScript and TypeScript code.

Installation

Install GlanceVibe globally using npm:

npm install -g glancevibe

Authentication

Before scanning, you need to authenticate with your API key:

glancevibe auth --login

You can also set the GLANCEVIBE_API_KEY environment variable.

Usage

Scan files

# Scan current directory
glancevibe scan

# Scan specific files or directories
glancevibe scan src/ lib/

# Scan with specific output format
glancevibe scan --format json
glancevibe scan --format sarif
glancevibe scan --format html

# Filter by severity
glancevibe scan --severity HIGH

# Filter by confidence
glancevibe scan --confidence high

# Exclude patterns
glancevibe scan --exclude "**/test/**" --exclude "**/*.spec.ts"

Check account status

glancevibe status

List available rules

glancevibe list-rules

Explain a rule

glancevibe explain GV-001

AI & LLM Usage

GlanceVibe is designed to work seamlessly with AI coding assistants like Cursor, Windsurf, and Codex. By providing structured security findings, you can empower your AI to not only find but also fix vulnerabilities in your codebase.

Instructions for AI Assistants

When using an AI assistant, you can provide it with the following instructions to help it secure your project:

Recommended AI Workflow:

  1. Install GlanceVibe: npm install -g glancevibe
  2. Run a scan with JSON output: glancevibe scan --format json
  3. Provide the JSON output to the AI and ask: "Review these security findings and propose surgical fixes for each issue, following security best practices."

AI Crawler Support (llms.txt)

We provide a standardized llms.txt file at the root of our domain for AI crawlers and LLMs to easily ingest our documentation and rule definitions.

Git-Aware Scanning

Scan only files that have changed, perfect for CI pipelines and pre-commit hooks:

# Scan uncommitted changes (staged + unstaged)
glancevibe scan --changed

# Scan only staged files (great for pre-commit hooks)
glancevibe scan --staged

# Scan files changed since a branch/tag/commit
glancevibe scan --since main
glancevibe scan --since HEAD~5
glancevibe scan --since v1.0.0

Baseline / Ignore Known Findings

Suppress known findings to focus on new issues:

# Generate a baseline from current findings
glancevibe scan --generate-baseline

# Apply baseline to suppress known findings
glancevibe scan --baseline

# Use a custom baseline file path
glancevibe scan --baseline ./custom-baseline.json
glancevibe scan --generate-baseline --baseline ./custom-baseline.json

The baseline file (.glancevibe-baseline.json) tracks findings by fingerprint, allowing for minor code changes without losing suppressions.

Dependency Scanning

Check your npm dependencies for known vulnerabilities:

# Standalone dependency scan
glancevibe deps

# Scan a specific directory
glancevibe deps ./my-project

# JSON output
glancevibe deps --format json

# Exclude devDependencies
glancevibe deps --no-dev

# Combined with code scan
glancevibe scan --include-deps

Scan History & Trends

Track your security posture over time:

# View scan history for current project
glancevibe history

# Limit number of entries
glancevibe history --limit 20

# View all projects with history
glancevibe history --all

# View security trends with ASCII visualization
glancevibe trends

# Analyze different time periods
glancevibe trends --days 7
glancevibe trends --days 90

# Export trend data as JSON
glancevibe trends --format json

Rule Reference

GlanceVibe uses a robust rule engine to identify security vulnerabilities. Each rule is carefully designed to minimize false positives and provide actionable recommendations.

IDNameCategorySeverityTier
GV-001SQL InjectionInjectionCRITICALBase
GV-002Command InjectionInjectionCRITICALBase
GV-003Dangerous EvalInjectionCRITICALBase
GV-004Server-Side Request ForgeryInjectionCRITICALPremium
GV-005NoSQL InjectionInjectionCRITICALPremium
GV-006Unsafe DeserializationInjectionCRITICALPremium
GV-007JWT Algorithm NoneAuthCRITICALPremium
GV-008Cross-Site Scripting (XSS)XSSHIGHBase
GV-009Hardcoded SecretsSecretsHIGHBase
GV-010Path TraversalInjectionHIGHBase
GV-011Prototype PollutionInjectionHIGHPremium
GV-012Weak CryptographyCryptoHIGHPremium
GV-013Missing Input SanitizationValidationMEDIUMPremium
GV-014Sensitive Data in StorageStorageHIGHPremium
GV-015Unrestricted File UploadUploadHIGHPremium
GV-016Missing Auth MiddlewareAuthHIGHPremium
GV-017Missing CSRF ProtectionAuthHIGHPremium
GV-018Client-side Only AuthAuthHIGHPremium
GV-019Insecure RandomnessCryptoHIGHPremium
GV-020Prompt InjectionLLMHIGHPremium
GV-021Vulnerable DependenciesDependenciesMEDIUMBase
GV-022Open RedirectRedirectMEDIUMPremium
GV-023ReDoSRegexMEDIUMPremium
GV-024Sensitive Data LoggingLoggingMEDIUMPremium
GV-025CORS MisconfigurationCORSMEDIUMPremium
GV-026Insecure CookiesCookiesMEDIUMPremium
GV-027Missing Error HandlingErrorMEDIUMPremium
GV-028Timing AttackCryptoMEDIUMPremium
GV-029Missing Security HeadersHeadersMEDIUMPremium
GV-030Sensitive Files ExposedGitignoreMEDIUMBase
GV-031Debug EndpointsDebugMEDIUMPremium
GV-032No Rate LimitingRatelimitMEDIUMPremium
GV-033Verbose Error MessagesErrorMEDIUMPremium
GV-034Host Header InjectionInjectionMEDIUMPremium
GV-035Quantity Not ValidatedValidationMEDIUMPremium
GV-036System Prompt LeakageLLMHIGHBase
GV-037Unsafe URL SchemesXSSHIGHBase
GV-038Unsafe postMessage OriginWebHIGHBase
GV-040GraphQL Introspection EnabledAPIMEDIUMPremium
GV-041GraphQL Query DoSAPIMEDIUMPremium
GV-042Mass AssignmentValidationHIGHPremium
GV-046IDOR PatternAuthHIGHPremium
GV-047In-Memory Rate LimitingRatelimitLOWPremium

Configuration

Create a .glanceviberc file in your project root:

{
  "severity": "MEDIUM",
  "format": "pretty",
  "exclude": ["**/node_modules/**", "**/*.test.ts"],
  "apiUrl": "https://api.glancevibe.com"
}

Or add a glancevibe key in your package.json:

{
  "glancevibe": {
    "severity": "MEDIUM",
    "exclude": ["**/test/**"]
  }
}

Output Formats

  • pretty(default): Colored terminal output with code snippets
  • jsonFull findings as JSON
  • sarifSARIF format for CI/CD integration (GitHub, GitLab)
  • htmlInteractive HTML report

Exit Codes

  • 0 - No critical or high severity findings
  • 1 - Critical or high severity findings detected, or scan error

CI/CD Integration

GitHub Actions

- name: Security Scan
  run: |
    npm install -g glancevibe
    glancevibe scan --format sarif > results.sarif
  env:
    GLANCEVIBE_API_KEY: ${{ secrets.GLANCEVIBE_API_KEY }}

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: results.sarif

PR-Only Scanning

Scan only changed files in pull requests:

- name: Security Scan (Changed Files)
  run: |
    npm install -g glancevibe
    glancevibe scan --since origin/main
  env:
    GLANCEVIBE_API_KEY: ${{ secrets.GLANCEVIBE_API_KEY }}

With Baseline

Ignore known findings and fail only on new issues:

- name: Security Scan with Baseline
  run: |
    npm install -g glancevibe
    glancevibe scan --baseline
  env:
    GLANCEVIBE_API_KEY: ${{ secrets.GLANCEVIBE_API_KEY }}

Pre-commit Hook

Add to .husky/pre-commit:

#!/bin/sh
glancevibe scan --staged --severity HIGH

Commands Reference

CommandDescription
scan [targets...]Scan files for security vulnerabilities
deps [target]Scan dependencies for known vulnerabilities
historyShow scan history for current project
trendsShow security trend visualization
authManage API authentication
statusShow account status and usage
list-rulesList available security rules
explain <rule>Explain a security rule

Scan Options

OptionDescription
-f, --format <format>Output format: pretty, json, sarif, html
-o, --output <path>Output file path
-s, --severity <level>Minimum severity: LOW, MEDIUM, HIGH, CRITICAL
-c, --confidence <level>Minimum confidence: low, medium, high
-e, --exclude <patterns...>Glob patterns to exclude
-i, --include <patterns...>Glob patterns to include
--changedScan only uncommitted changes
--stagedScan only staged files
--since <ref>Scan files changed since ref
--generate-baselineGenerate baseline file
--baseline [path]Apply baseline to suppress findings
--include-depsInclude dependency vulnerability scan
-v, --verboseVerbose output

GlanceVibe CLI is licensed under the MIT License.