Will It Vibe?'read' prompts for a password without -s
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
read -p "..." whose prompt text asks for a password/secret/token, without also passing -s, echoes every keystroke to the terminal as the user types it. Anyone shoulder-surfing or reviewing a captured terminal session/asciinema recording sees the credential in plain sight. Add -s so the input is silent.
Why it matters
read -p "..." whose prompt text asks for a password, secret, or token, without also passing -s, echoes every keystroke to the terminal as the user types it. Anyone looking over their shoulder, or reviewing a captured terminal session, a CI log, an asciinema recording, a screen-share, sees the credential appear in plain text.
How to fix it
Add -s to the read call so the input is silent (read -sp "Enter database password: " DB_PASSWORD). Since -s also suppresses the newline the user's Enter key would normally produce, follow it with a bare echo so the next output does not run onto the same line.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo