| name | vibe-security-audit |
| description | Audits codebases for security vulnerabilities common in AI-assisted (vibe coded) projects. Runs a 30-point checklist covering secrets exposure, injection attacks, auth misconfig, CORS, dependency vulnerabilities, and production readiness. Use when reviewing code for security issues, preparing for deployment, or when the user mentions security audit, vulnerability check, or vibe coding security. |
| license | MIT |
| metadata | {"author":"Kedasha | @itsthatladydev","version":"3.0"} |
Vibe Security Audit
Perform a 30-point security audit on the target code. If an argument is provided, focus on $ARGUMENTS. Otherwise, audit the entire project.
Contents
Step 1: Detect Tech Stack
Identify what to check by examining these files:
| Detect | Look for |
|---|
| Framework | next.config.*, nuxt.config.*, astro.config.*, vite.config.* |
| Package manager | package.json, requirements.txt, go.mod, Gemfile |
| Database | prisma/, drizzle.config.*, supabase/, firebase.json |
| Auth | Imports: @clerk, next-auth, @supabase/auth, @auth0, lucia |
| Storage | Imports: @aws-sdk/client-s3, @supabase/storage, @google-cloud/storage |
| AI APIs | Imports: openai, @anthropic-ai/sdk, @google/generative-ai |
| Payment | Imports: stripe, @paddle/paddle-node |
| Email | Imports: resend, @sendgrid/mail, nodemailer |
| Deployment | vercel.json, netlify.toml, fly.toml, Dockerfile |
Skip checks that don't apply to the detected stack.
Step 2: Run Audit
Copy this checklist and check off items as you complete them:
Audit Progress:
- [ ] Step 1: Detect tech stack
- [ ] Step 2a: Run critical checks (1, 3, 5, 6, 11) — see checks/critical.md
- [ ] Step 2b: Run standard checks (2, 4, 7-10, 12-20) — see checks/standard.md
- [ ] Step 2c: Run production checks (21-30) — see checks/production.md
- [ ] Step 3: Calculate score and compile report
Run critical checks first — read checks/critical.md and execute all 5 checks before proceeding.
Then read checks/standard.md and checks/production.md for remaining checks. Skip any that don't apply to the detected stack.
Step 3: Score and Report
Severity Scale
| Score | Level | Action |
|---|
| 10/10 | Critical | Fix before deploying |
| 8-9/10 | High | Fix within 24 hours |
| 6-7/10 | Medium | Fix within 1 week |
| 4-5/10 | Low | Fix when convenient |
| 1-3/10 | Informational | Consider addressing |
Project score = 100 minus sum of severity scores for all issues found (minimum 0).
| Score | Rating |
|---|
| 90-100 | Excellent |
| 70-89 | Good — minor issues |
| 50-69 | Fair — needs attention |
| 30-49 | Poor — significant risk |
| 0-29 | Critical — do not deploy |
Output Format
# Security Audit Report
## Detected Tech Stack
- **Framework**: [detected]
- **Database**: [detected]
- **Auth**: [detected]
- **Deployment**: [detected]
- **Other**: [AI APIs, payment, email, storage if detected]
## Summary
[1-2 sentence overview]
**Project Score**: [X/100] — [Rating]
**Checks Run**: [X/30]
**Issues Found**: [count]
## Quick Wins (fixable in under 10 minutes)
| # | Issue | Severity | Fix Time | Fix |
|---|-------|----------|----------|-----|
| 1 | [issue] | [X/10] | [time] | [one-line fix] |
## Critical Issues (Severity 8-10)
- **[Check Name]** (Severity: X/10)
- File: [file:line]
- Pattern matched: [what was found]
- Fix: [specific remediation]
## High Priority (Severity 6-7)
[Same format]
## Medium Priority (Severity 4-5)
[Same format]
## Low Priority (Severity 1-3)
[Same format]
## Passed Checks
[Check number and name for each passing check]
## Not Applicable
[Check number, name, and reason skipped]
Reference exact files and line numbers. Show which pattern matched. Provide actionable fix instructions for every issue.
