| name | vibe-coding-security |
| description | Security review workflow for AI-generated apps, vibe coding projects, AI agents, UGC products, login flows, file uploads, payment/credit systems, prompt-based features, and public product launches. Use before coding, during code review, before deployment, or whenever a user asks whether an AI-built feature is safe to publish. |
| metadata | null |
| version | 1.0.0 |
| author | project |
vibe-coding-security
Purpose
Use this skill to review AI-generated or vibe-coded software for overlooked security, privacy, abuse, cost, and boundary risks before development, merge, or public launch.
Default stance:
- AI-generated code is not trusted.
- Frontend checks are not security boundaries.
- Prompt instructions are not security boundaries.
- User input, AI output, external documents, third-party API responses, uploaded files, and database records are untrusted.
- Public products require security gates before launch.
When to Use
Use this skill when the task involves:
- AI-assisted coding, vibe coding, agentic development, Copilot, Claude Code, Codex, Cursor, or multi-agent workflows.
- Login, registration, sessions, tokens, CAPTCHA, SMS, email verification, or OAuth.
- UGC: comments, nicknames, bios, posts, messages, images, avatars, reviews, public feeds.
- File upload, image upload, object storage, CDN, OCR, image generation, or media processing.
- AI chat, AI roleplay, RAG, tool-calling agents, memory, system prompts, model APIs, or prompt templates.
- Credits, points, membership, payments, invite rewards, task rewards, quotas, rankings, or billing.
- Public deployment, production release, security review, code review, or launch readiness.
Operating Rules
- Do not only check whether the feature works. Check whether it can be abused.
- Separate product functionality from security boundaries.
- Check backend enforcement, not just UI behavior.
- Check object-level authorization on every resource.
- Check all cost-bearing interfaces for rate limits and budget caps.
- Check whether secrets, prompts, debug traces, logs, and internal fields are exposed.
- Check whether AI output can reach HTML, SQL, shell, tools, files, emails, payments, or databases without validation.
- For high-risk issues, mark the feature as blocking launch.
- If evidence is missing, say “not verified” instead of assuming it is safe.
- Prefer precise findings with file, route, function, or component names.
Review Workflow
1. Scope the Feature
Identify:
- Feature name.
- User roles involved.
- Public/private surfaces.
- Data accepted.
- Data stored.
- Data displayed.
- External services called.
- Cost-bearing operations.
- AI/model/tool involvement.
- Deployment environment.
If scope is unclear, ask for the missing code, route list, schema, environment design, or architecture before approving.
2. Classify Risk Areas
Check all applicable categories:
- Authentication
- Authorization
- UGC/content safety
- File upload/media
- Cost-bearing APIs
- AI prompt/agent/tool risks
- Database/API safety
- Business logic abuse
- Privacy/logging
- Frontend exposure
- Supply chain
- Deployment/operations
3. Inspect Critical Boundaries
For each category, verify the actual enforcement point. Backend or infrastructure enforcement is required for security-sensitive behavior.
Examples:
- Login required: server middleware or route guard.
- Ownership: database query includes
userId, ownerId, or tenantId.
- Rate limit: server-side limiter keyed by IP/user/device/target.
- Upload safety: backend-issued short-lived credential plus server-side verification.
- AI tool safety: allowlisted tools plus human confirmation for high-impact actions.
- Payment safety: backend-created order plus signed webhook plus idempotency.
4. Report Findings
Use this format:
Risk: Critical | High | Medium | Low
Area:
Location:
Problem:
Attack path:
Impact:
Fix:
Launch blocking: Yes | No
Verification needed:
Security Checklist
Authentication
Check:
- All private routes enforce server-side authentication.
- Sessions/tokens expire.
- Refresh tokens rotate or are revocable.
- Cookies use
HttpOnly, Secure, and appropriate SameSite.
- Login failure has throttling.
- Password reset and account binding flows are rate-limited.
- OAuth callback validates state/nonce and redirect targets.
- Verification codes expire and have retry limits.
Red flags:
- Login only checked in frontend.
- Token stored in localStorage for sensitive apps.
- Verification code endpoint can be called repeatedly.
- SMS/email code can be brute-forced.
- Auth state derived from user-controlled client data.
Authorization and Resource Ownership
Check:
- Every read/update/delete verifies resource ownership or tenant membership.
- Admin APIs enforce admin role server-side.
- User role is not accepted from request body.
- Resource IDs in URLs cannot be swapped to access other users’ data.
- Bulk operations verify every affected record.
Red flags:
- Query uses only
id, not id + ownerId.
- Frontend hides admin buttons but backend lacks checks.
- API returns records from other tenants.
- Role or membership can be edited by the user.
UGC and Content Safety
Check all user-editable fields:
- Nickname
- Avatar
- Bio
- Comment
- Post
- Message
- Review
- Public feed
- AI chat content
- Shared prompt
- Uploaded image/video/audio
- External links and QR codes
Require:
- Length limits.
- Schema validation.
- XSS protection.
- Moderation before public display for high-risk content.
- Report/delete/block flows.
- Abuse throttling.
- Public/private visibility controls.
- Audit trail for moderation actions.
Red flags:
- User text is written directly to public feeds.
- Markdown or HTML rendered without sanitization.
- Comments can contain scripts, links, QR codes, or impersonation.
- AI output is published without moderation.
- No report or takedown mechanism.
File Upload and Media
Check:
- File size limit.
- MIME and extension checks.
- Real file signature validation.
- EXIF stripping.
- Image re-encoding.
- Virus/malware scan if accepting arbitrary files.
- Separate quarantine and public buckets.
- Short-lived upload credentials.
- User quota and cost limits.
- Randomized storage keys.
- No public write access.
- CDN does not expose private files.
Red flags:
- Direct upload to public bucket.
- Upload credential is long-lived.
- User controls file path or filename.
- Uploaded file immediately becomes public.
- SVG/HTML/PDF accepted without special handling.
- EXIF GPS data remains in public images.
Cost-Bearing APIs
Treat these as high risk:
- SMS
- Email
- Push notification
- AI model call
- Image/video generation
- OCR
- TTS/STT
- Translation
- Storage upload
- CDN bandwidth
- Payment provider
- Map/geocoding APIs
- Third-party paid APIs
Require:
- IP rate limit.
- User rate limit.
- Target rate limit, such as phone/email.
- Device/session throttling when available.
- Daily quota.
- Budget cap.
- Retry cap.
- Abuse alert.
- Idempotency key for state-changing calls.
- Server-side signature or challenge for sensitive flows.
Red flags:
- SMS/email endpoint callable by curl without challenge.
- AI endpoint has no token/output limit.
- Generation endpoint has no user quota.
- Retry loop can multiply costs.
- API key exposed to frontend.
AI Prompt, Agent, RAG, and Tool Safety
Check:
- System prompts stay server-side.
- Prompt templates are not included in frontend bundles.
- Prompt, tool traces, and provider raw responses are not logged publicly.
- External content is treated as data, not instruction.
- RAG documents cannot override system rules.
- AI output is validated before use.
- AI output is never directly executed as SQL, shell, code, HTML, email, payment, or tool arguments.
- Tools are allowlisted and narrow.
- High-impact tools require human confirmation.
- Agent memory is user-scoped, inspectable, deletable, and disableable.
Red flags:
- System prompt visible in frontend code, API response, logs, or error messages.
- Prompt says “do not reveal rules” but no code-level protection exists.
- Agent can call generic
run_shell, execute_sql, http_request, or send_email without constraints.
- AI can modify permissions, delete data, publish content, or spend money automatically.
- User-provided PDF/webpage/comment can instruct the agent to ignore rules.
- Memory can persist attacker instructions.
Database and API Safety
Check:
- Inputs use schema validation.
- Queries are parameterized or ORM-safe.
- No string-built SQL/NoSQL queries.
- Pagination exists on list endpoints.
- Mutations use transactions when needed.
- Unique constraints exist for critical invariants.
- Deletes are intentional: soft vs hard delete is defined.
- API responses exclude sensitive fields.
- Errors do not reveal internals.
Red flags:
- API returns
passwordHash, tokens, secrets, prompts, raw provider responses, internal roles, or debug traces.
- List endpoint returns all rows.
- Request body controls
userId, role, price, quota, isAdmin, status, or ownerId.
- No transaction around balance, credits, membership, or order changes.
Business Logic Abuse
Check:
- Credits, points, rewards, quotas, membership, rankings, payments, and task completion are computed server-side.
- Payment amount is server-defined.
- Webhook signature is verified.
- Payment callback is idempotent.
- Invite rewards cannot self-refer or loop.
- Sign-in/check-in/reward flows cannot be replayed.
- AI usage quota cannot be bypassed by changing client state.
Red flags:
- Price, membership, points, or quota are accepted from frontend.
- User can repeat reward endpoints.
- Webhook can be replayed.
- Order status can be changed by client request.
- Ranking, likes, comments, or follows have no anti-abuse limits.
Privacy, Logging, and Errors
Do not log:
- Passwords
- Tokens
- Cookies
- Verification codes
- Full phone/email when unnecessary
- API keys
- Private messages
- System prompts
- AI memory
- Payment details
- Raw provider responses
- Sensitive uploaded file metadata
Check:
- Production errors return generic messages.
- Stack traces are not exposed to users.
- Logs are access-controlled.
- Sensitive values are redacted.
- Data retention is defined.
- Users can delete/export personal data if product requires it.
Frontend Exposure
Check frontend bundle and public assets for:
- API keys
- System prompts
- Internal routes
- Admin endpoints
- Feature flags for unreleased features
- Source maps
- Upload credentials
- Payment logic
- Moderation rules
- Debug configs
Red flags:
NEXT_PUBLIC_ contains sensitive values.- Public source maps expose prompt templates or internal logic.
- localStorage stores sensitive tokens or private data.
- Frontend controls authorization, quota, price, or membership.
Supply Chain
Before accepting AI-suggested dependencies, check:
- Official package identity.
- Maintenance activity.
- License.
- Known vulnerabilities.
- Typosquatting risk.
postinstall or lifecycle scripts.- Unnecessary transitive weight.
- Lockfile committed.
Run when available:
npm audit
pnpm audit
gitleaks detect
semgrep scan
trivy fs .
Red flags:
- Unknown package with low adoption.
- Package name looks similar to a popular package.
- Dependency added only because AI suggested it.
- No lockfile.
- Secrets found in repository.
Deployment and Operations
Check:
- Debug mode off.
- Test routes disabled.
- Admin routes protected.
- CORS not wildcard for credentialed requests.
- Database not public.
- Object storage permissions correct.
- CDN does not cache private data.
- Environment variables do not leak into build output.
- Source maps are private or disabled.
- Monitoring and alerting exist.
- Backup and rollback plan exist.
Severity Guide
Use Critical when:
- Auth bypass.
- Cross-user data access.
- Secret/key exposure.
- Payment or credit manipulation.
- Unrestricted file upload to public storage.
- Agent can execute high-impact tools without confirmation.
- SMS/AI/paid API can be abused at scale.
- System prompt or private user data exposed publicly.
Use High when:
- Missing authorization on important actions.
- UGC public posting without moderation.
- XSS likely exploitable.
- File upload lacks server-side verification.
- Sensitive logs accessible internally without controls.
- Prompt injection can affect tool behavior.
Use Medium when:
- Incomplete rate limiting.
- Overbroad API responses.
- Weak error handling.
- Missing pagination.
- Minor privacy leakage.
- Missing audit logs for important actions.
Use Low when:
- Hardening improvement.
- Documentation gap.
- Non-sensitive validation gap.
- Minor configuration issue with limited impact.
Required Output
When reviewing a project or module, produce:
## Security Review Summary
Overall launch status: Pass | Blocked | Not enough evidence
Critical:
- ...
High:
- ...
Medium:
- ...
Low:
- ...
## Most Important Fixes
1. ...
2. ...
3. ...
## Boundary Decisions
- What must be enforced server-side:
- What must never be trusted from frontend:
- What AI must never be allowed to do automatically:
- What requires human confirmation:
## Verification Checklist
[ ] Auth verified
[ ] Authorization verified
[ ] UGC safety verified
[ ] File upload verified
[ ] Cost API limits verified
[ ] AI prompt/agent safety verified
[ ] Database/API safety verified
[ ] Business logic verified
[ ] Logging/privacy verified
[ ] Frontend exposure verified
[ ] Supply chain verified
[ ] Deployment verified
Final Rule
If a feature is publicly reachable, stores user data, spends money, calls AI tools, publishes UGC, or changes account/payment/permission state, do not approve it until backend enforcement, abuse limits, and privacy boundaries are verified.
