@korayda4/vibe-security

Vibe Security

Stable release: 1.4.0

The security guard for Vibe Coded projects. Every line of AI-generated Frontend or Backend code is planned, tested, and scanned across all layers and languages. Auto-fix patches included for the most common mistakes. Built-in 3-tier pre-build gate with on-the-fly auto-patching heals vulnerabilities to keep builds moving.

What is Vibe Security?

Vibe Security is the AI skill & MCP server for catching security mistakes in code generated by AI agents (Antigravity, Gemini CLI, Claude Code, Cursor, VS Code).

For every change in a Vibe Coded project, the MCP server, Agent Skill, or CLI:

1. Plans — maps the project's languages and frameworks (React, Next.js, Express, Django, .NET, etc.)
2. Tests — runs the scan against 40 rules across 6 layers
3. Finds — XSS, SQLi, IDOR, client-side LLM leaks, Next.js Server Action auth gaps, hardcoded secrets, misconfigured CORS, and more
4. Explains — every finding has CWE, OWASP, threat model, and step-by-step fix
5. Fixes — auto-patch for the most common mistakes (FE-001 DOMPurify, FE-004 source maps, NET-002 CORS, AI-001 client LLM leak, OBS-001 stack traces)

Finding snippets redact token-shaped values before they are written to Security.md or returned to an AI tool. Targeted language and layer scans keep results focused and token usage predictable.

Install

From npm

npm install -g @korayda4/vibe-security

From GitHub (pre-publish or alternative channel)

npx -y github:korayda4/Vibe-Security init

MCP server config

Claude Code — ~/.claude/mcp_servers.json:

{
  "mcpServers": {
    "vibe-security": { "command": "vibe-security" }
  }
}

VS Code Anthropic Claude extension — .vscode/settings.json:

{
  "mcp.servers": {
    "vibe-security": { "command": "vibe-security", "type": "stdio" }
  }
}

After install, restart your editor. The /securityCheck slash command will be available.

Use

/securityCheck                  full project scan, writes Security.md
/securityCheck --frontend       only frontend layer
/securityCheck --fix            preview + apply auto-fixes
/securityCheck --baseline       only NEW findings vs baseline
/securityCheck --rule BE-004    single rule
/securityCheck --format sarif   SARIF output for CI

Or talk to Claude naturally:

"Run a security scan on this project." "Any IDOR or SQL injection in the backend?" "Explain FE-001 in detail."

Languages & Frameworks

Frontend technologies

React · Next.js · Vue.js · AngularJS · Svelte

Vibe Security scans every Frontend angle:

• XSS in innerHTML / dangerouslySetInnerHTML / <%= raw %> / unsafe { + }
• Cookie flags (HttpOnly, Secure, SameSite)
• Public env leaks (NEXT_PUBLIC_*, REACT_APP_*)
• Source maps in production
• Clickjacking protection
• eval / Function / setTimeout(string) misuse
• CSP / HSTS / X-Content-Type-Options / Referrer-Policy / Permissions-Policy

Backend technologies

Node.js · Express · Fastify · NestJS · Django · Flask · FastAPI · Rails · Sinatra · Laravel · Symfony · WordPress · Spring · ASP.NET Core · Blazor · Actix · Axum · Gin · Fiber · C/C++

Vibe Security scans every Backend angle:

• IDOR / BOLA — ownership not verified
• SQL / NoSQL injection (string concatenation, f-string, format!)
• JWT alg: none, weak secret, missing expiry
• Mass assignment — input not whitelisted
• Weak password hashing (MD5 / SHA-1 / SHA-256)
• Token in URL query/path
• Long-lived tokens without expiry
• Missing rate limiting on auth endpoints
• Unsafe file upload (original filename used)
• Hardcoded secrets / API keys / AWS keys

Detection sources

package.json, composer.json, Gemfile, requirements.txt, pyproject.toml, go.mod, Cargo.toml, *.csproj, *.sln, CMakeLists.txt. Smart detection via file extension, shebang (#!/usr/bin/env python3), and syntax sniffing.

How it works in a Vibe Coded project

Geliştirici / AI Build Alır (npm run build)
    │
    ▼
"prebuild": "vibe-security check-build" ──► Pre-Build Gatekeeper
    │
    ├─► [SUCCESS]                0 açık ──► Build başarıyla devam eder (Exit 0)
    ├─► [WARNING]   Medium / Low / Lint ──► Uyarılar listelenir, build devam eder (Exit 0)
    └─► [SECURITY_VULNERABILITY]  Crit/High ──► BUILD ENGELLENİR! (Exit 1)
                                                 │
                                                 ▼
               /securityCheck veya npx vibe-security scan . --fix
               (Araştırma, detaylı klasör taraması, AAP ile otomatik düzeltme)

Pre-Build Gate vs. Interactive Scan

Output

Important: Security.md is generated at runtime in YOUR project. It is not part of this repo and is gitignored by default. Sample structure: docs/SECURITY_REPORT.example.md.

Configuration

.vibe-security.json:

{
  "rules": { "FE-006": { "enabled": false } },
  "ignore": ["**/vendor/**"],
  "output": { "format": "sarif" }
}

CI/CD

- run: npx -y @korayda4/vibe-security scan . --format sarif --output vibe-security.sarif
- uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: vibe-security.sarif }

Baseline for PR-only-new-findings:

vibe-security scan . --update-baseline --no-fail    # main branch
vibe-security scan . --baseline .vibe-security-baseline.json    # PR branch

Full GitHub Actions: examples/github-actions.yml.

Use --layers frontend or --layers backend for focused scans, and combine it with --rules when reviewing a specific control.

Performance

Compatibility

Node.js 18+.

More

• docs/USAGE.md — every flag, every output format
• docs/TOKEN_SAFETY.md — JWT, refresh tokens, rotation
• docs/VULNERABILITY_PRIORITY.md — clusters by priority
• docs/CONTRIBUTING.md — add a new rule
• ROADMAP.md — phases and what is next

Maintainer

Koray Demir · koraydemirmc@gmail.com · github.com/korayda4

License

MIT — see LICENSE.