vibe-coding-security

name	vibe-coding-security
description	Security review workflow for AI-generated apps, vibe coding projects, AI agents, UGC products, login flows, file uploads, payment/credit systems, prompt-based features, and public product launches. Use before coding, during code review, before deployment, or whenever a user asks whether an AI-built feature is safe to publish.
metadata	null
version	1.0.0
author	project

---

vibe-coding-security

Purpose

Use this skill to review AI-generated or vibe-coded software for overlooked security, privacy, abuse, cost, and boundary risks before development, merge, or public launch.

Default stance:

• AI-generated code is not trusted.
• Frontend checks are not security boundaries.
• Prompt instructions are not security boundaries.
• User input, AI output, external documents, third-party API responses, uploaded files, and database records are untrusted.
• Public products require security gates before launch.

When to Use

Use this skill when the task involves:

• AI-assisted coding, vibe coding, agentic development, Copilot, Claude Code, Codex, Cursor, or multi-agent workflows.
• Login, registration, sessions, tokens, CAPTCHA, SMS, email verification, or OAuth.
• UGC: comments, nicknames, bios, posts, messages, images, avatars, reviews, public feeds.
• File upload, image upload, object storage, CDN, OCR, image generation, or media processing.
• AI chat, AI roleplay, RAG, tool-calling agents, memory, system prompts, model APIs, or prompt templates.
• Credits, points, membership, payments, invite rewards, task rewards, quotas, rankings, or billing.
• Public deployment, production release, security review, code review, or launch readiness.

Operating Rules

1. Do not only check whether the feature works. Check whether it can be abused.
2. Separate product functionality from security boundaries.
3. Check backend enforcement, not just UI behavior.
4. Check object-level authorization on every resource.
5. Check all cost-bearing interfaces for rate limits and budget caps.
6. Check whether secrets, prompts, debug traces, logs, and internal fields are exposed.
7. Check whether AI output can reach HTML, SQL, shell, tools, files, emails, payments, or databases without validation.
8. For high-risk issues, mark the feature as blocking launch.
9. If evidence is missing, say “not verified” instead of assuming it is safe.
10. Prefer precise findings with file, route, function, or component names.

Review Workflow

1. Scope the Feature

Identify:

• Feature name.
• User roles involved.
• Public/private surfaces.
• Data accepted.
• Data stored.
• Data displayed.
• External services called.
• Cost-bearing operations.
• AI/model/tool involvement.
• Deployment environment.

If scope is unclear, ask for the missing code, route list, schema, environment design, or architecture before approving.

2. Classify Risk Areas

Check all applicable categories:

• Authentication
• Authorization
• UGC/content safety
• File upload/media
• Cost-bearing APIs
• AI prompt/agent/tool risks
• Database/API safety
• Business logic abuse
• Privacy/logging
• Frontend exposure
• Supply chain
• Deployment/operations

3. Inspect Critical Boundaries

For each category, verify the actual enforcement point. Backend or infrastructure enforcement is required for security-sensitive behavior.

Examples:

• Login required: server middleware or route guard.
• Ownership: database query includes userId, ownerId, or tenantId.
• Rate limit: server-side limiter keyed by IP/user/device/target.
• Upload safety: backend-issued short-lived credential plus server-side verification.
• AI tool safety: allowlisted tools plus human confirmation for high-impact actions.
• Payment safety: backend-created order plus signed webhook plus idempotency.

4. Report Findings

Use this format:

Risk: Critical | High | Medium | Low
Area:
Location:
Problem:
Attack path:
Impact:
Fix:
Launch blocking: Yes | No
Verification needed:

Security Checklist

Authentication

Check:

• All private routes enforce server-side authentication.
• Sessions/tokens expire.
• Refresh tokens rotate or are revocable.
• Cookies use HttpOnly, Secure, and appropriate SameSite.
• Login failure has throttling.
• Password reset and account binding flows are rate-limited.
• OAuth callback validates state/nonce and redirect targets.
• Verification codes expire and have retry limits.

Red flags:

• Login only checked in frontend.
• Token stored in localStorage for sensitive apps.
• Verification code endpoint can be called repeatedly.
• SMS/email code can be brute-forced.
• Auth state derived from user-controlled client data.

Authorization and Resource Ownership

Check:

• Every read/update/delete verifies resource ownership or tenant membership.
• Admin APIs enforce admin role server-side.
• User role is not accepted from request body.
• Resource IDs in URLs cannot be swapped to access other users’ data.
• Bulk operations verify every affected record.

Red flags:

• Query uses only id, not id + ownerId.
• Frontend hides admin buttons but backend lacks checks.
• API returns records from other tenants.
• Role or membership can be edited by the user.

UGC and Content Safety

Check all user-editable fields:

• Nickname
• Avatar
• Bio
• Comment
• Post
• Message
• Review
• Public feed
• AI chat content
• Shared prompt
• Uploaded image/video/audio
• External links and QR codes

Require:

• Length limits.
• Schema validation.
• XSS protection.
• Moderation before public display for high-risk content.
• Report/delete/block flows.
• Abuse throttling.
• Public/private visibility controls.
• Audit trail for moderation actions.

Red flags:

• User text is written directly to public feeds.
• Markdown or HTML rendered without sanitization.
• Comments can contain scripts, links, QR codes, or impersonation.
• AI output is published without moderation.
• No report or takedown mechanism.

File Upload and Media

Check:

• File size limit.
• MIME and extension checks.
• Real file signature validation.
• EXIF stripping.
• Image re-encoding.
• Virus/malware scan if accepting arbitrary files.
• Separate quarantine and public buckets.
• Short-lived upload credentials.
• User quota and cost limits.
• Randomized storage keys.
• No public write access.
• CDN does not expose private files.

Red flags:

• Direct upload to public bucket.
• Upload credential is long-lived.
• User controls file path or filename.
• Uploaded file immediately becomes public.
• SVG/HTML/PDF accepted without special handling.
• EXIF GPS data remains in public images.

Cost-Bearing APIs

Treat these as high risk:

• SMS
• Email
• Push notification
• AI model call
• Image/video generation
• OCR
• TTS/STT
• Translation
• Storage upload
• CDN bandwidth
• Payment provider
• Map/geocoding APIs
• Third-party paid APIs

Require:

• IP rate limit.
• User rate limit.
• Target rate limit, such as phone/email.
• Device/session throttling when available.
• Daily quota.
• Budget cap.
• Retry cap.
• Abuse alert.
• Idempotency key for state-changing calls.
• Server-side signature or challenge for sensitive flows.

Red flags:

• SMS/email endpoint callable by curl without challenge.
• AI endpoint has no token/output limit.
• Generation endpoint has no user quota.
• Retry loop can multiply costs.
• API key exposed to frontend.

AI Prompt, Agent, RAG, and Tool Safety

Check:

• System prompts stay server-side.
• Prompt templates are not included in frontend bundles.
• Prompt, tool traces, and provider raw responses are not logged publicly.
• External content is treated as data, not instruction.
• RAG documents cannot override system rules.
• AI output is validated before use.
• AI output is never directly executed as SQL, shell, code, HTML, email, payment, or tool arguments.
• Tools are allowlisted and narrow.
• High-impact tools require human confirmation.
• Agent memory is user-scoped, inspectable, deletable, and disableable.

Red flags:

• System prompt visible in frontend code, API response, logs, or error messages.
• Prompt says “do not reveal rules” but no code-level protection exists.
• Agent can call generic run_shell, execute_sql, http_request, or send_email without constraints.
• AI can modify permissions, delete data, publish content, or spend money automatically.
• User-provided PDF/webpage/comment can instruct the agent to ignore rules.
• Memory can persist attacker instructions.

Database and API Safety

Check:

• Inputs use schema validation.
• Queries are parameterized or ORM-safe.
• No string-built SQL/NoSQL queries.
• Pagination exists on list endpoints.
• Mutations use transactions when needed.
• Unique constraints exist for critical invariants.
• Deletes are intentional: soft vs hard delete is defined.
• API responses exclude sensitive fields.
• Errors do not reveal internals.

Red flags:

• API returns passwordHash, tokens, secrets, prompts, raw provider responses, internal roles, or debug traces.
• List endpoint returns all rows.
• Request body controls userId, role, price, quota, isAdmin, status, or ownerId.
• No transaction around balance, credits, membership, or order changes.

Business Logic Abuse

Check:

• Credits, points, rewards, quotas, membership, rankings, payments, and task completion are computed server-side.
• Payment amount is server-defined.
• Webhook signature is verified.
• Payment callback is idempotent.
• Invite rewards cannot self-refer or loop.
• Sign-in/check-in/reward flows cannot be replayed.
• AI usage quota cannot be bypassed by changing client state.

Red flags:

• Price, membership, points, or quota are accepted from frontend.
• User can repeat reward endpoints.
• Webhook can be replayed.
• Order status can be changed by client request.
• Ranking, likes, comments, or follows have no anti-abuse limits.

Privacy, Logging, and Errors

Do not log:

• Passwords
• Tokens
• Cookies
• Verification codes
• Full phone/email when unnecessary
• API keys
• Private messages
• System prompts
• AI memory
• Payment details
• Raw provider responses
• Sensitive uploaded file metadata

Check:

• Production errors return generic messages.
• Stack traces are not exposed to users.
• Logs are access-controlled.
• Sensitive values are redacted.
• Data retention is defined.
• Users can delete/export personal data if product requires it.

Frontend Exposure

Check frontend bundle and public assets for:

• API keys
• System prompts
• Internal routes
• Admin endpoints
• Feature flags for unreleased features
• Source maps
• Upload credentials
• Payment logic
• Moderation rules
• Debug configs

Red flags:

• NEXT_PUBLIC_ contains sensitive values.
• Public source maps expose prompt templates or internal logic.
• localStorage stores sensitive tokens or private data.
• Frontend controls authorization, quota, price, or membership.

Supply Chain

Before accepting AI-suggested dependencies, check:

• Official package identity.
• Maintenance activity.
• License.
• Known vulnerabilities.
• Typosquatting risk.
• postinstall or lifecycle scripts.
• Unnecessary transitive weight.
• Lockfile committed.

Run when available:

npm audit
pnpm audit
gitleaks detect
semgrep scan
trivy fs .

Red flags:

• Unknown package with low adoption.
• Package name looks similar to a popular package.
• Dependency added only because AI suggested it.
• No lockfile.
• Secrets found in repository.

Deployment and Operations

Check:

• Debug mode off.
• Test routes disabled.
• Admin routes protected.
• CORS not wildcard for credentialed requests.
• Database not public.
• Object storage permissions correct.
• CDN does not cache private data.
• Environment variables do not leak into build output.
• Source maps are private or disabled.
• Monitoring and alerting exist.
• Backup and rollback plan exist.

Severity Guide

Use Critical when:

• Auth bypass.
• Cross-user data access.
• Secret/key exposure.
• Payment or credit manipulation.
• Unrestricted file upload to public storage.
• Agent can execute high-impact tools without confirmation.
• SMS/AI/paid API can be abused at scale.
• System prompt or private user data exposed publicly.

Use High when:

• Missing authorization on important actions.
• UGC public posting without moderation.
• XSS likely exploitable.
• File upload lacks server-side verification.
• Sensitive logs accessible internally without controls.
• Prompt injection can affect tool behavior.

Use Medium when:

• Incomplete rate limiting.
• Overbroad API responses.
• Weak error handling.
• Missing pagination.
• Minor privacy leakage.
• Missing audit logs for important actions.

Use Low when:

• Hardening improvement.
• Documentation gap.
• Non-sensitive validation gap.
• Minor configuration issue with limited impact.

Required Output

When reviewing a project or module, produce:

## Security Review Summary

Overall launch status: Pass | Blocked | Not enough evidence

Critical:
- ...

High:
- ...

Medium:
- ...

Low:
- ...

## Most Important Fixes

1. ...
2. ...
3. ...

## Boundary Decisions

- What must be enforced server-side:
- What must never be trusted from frontend:
- What AI must never be allowed to do automatically:
- What requires human confirmation:

## Verification Checklist

[ ] Auth verified
[ ] Authorization verified
[ ] UGC safety verified
[ ] File upload verified
[ ] Cost API limits verified
[ ] AI prompt/agent safety verified
[ ] Database/API safety verified
[ ] Business logic verified
[ ] Logging/privacy verified
[ ] Frontend exposure verified
[ ] Supply chain verified
[ ] Deployment verified

Final Rule

If a feature is publicly reachable, stores user data, spends money, calls AI tools, publishes UGC, or changes account/payment/permission state, do not approve it until backend enforcement, abuse limits, and privacy boundaries are verified.