Will It Vibe?MD5 hash algorithm in use
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A call constructs an MD5 digest. MD5 is collision-broken and should not be used for signatures, integrity, or deduplication of security-relevant data. This flags MD5 usage that is not already on a line with credential naming.
Why it matters
MD5 is collision-broken, so it cannot be trusted for signatures, integrity verification, or deduplicating security-relevant data because an attacker can craft two inputs with the same digest. It is still common in legacy code as a content hash. When that content later carries a security decision, the weak hash becomes a real hole.
How to fix it
Use SHA-256 (or SHA-3 / BLAKE2) wherever the hash guards integrity or identity. MD5 is acceptable only for non-adversarial bucketing such as cache keys or ETags on trusted data, and even then SHA-256 is a safer default. Confirm each call site is not part of a signature or verification path before leaving it.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo