Run a full security audit on your vibe-coded project
Scans vibe-coded projects for security vulnerabilities including secrets, auth, RLS, and dependencies.
/plugin marketplace add Rahat-ch/vibe-check/plugin install rahat-ch-vibe-check@Rahat-ch/vibe-checkScan your project for common security issues that plague vibe-coded projects.
Usage: /vibe-check
Before running any checks, verify if .vibecheck/acknowledged file exists in project root.
If NOT exists, display this disclaimer and use AskUserQuestion:
DISCLAIMER
Vibe Check is a helpful guide for common security pitfalls - NOT a replacement for professional security audits.
By using this tool you acknowledge:
- This is educational guidance, not a comprehensive security audit
- Passing all checks does NOT guarantee your app is secure
- You are solely responsible for your application's security
- Vibe Check and its creators assume no liability
For production apps handling sensitive data, always get a professional security review.
Do you understand and accept these terms?
Options:
If user accepts:
.vibecheck/acknowledged file with timestampIf user declines:
For subsequent runs, skip disclaimer if .vibecheck/acknowledged exists.
Run all security checks in priority order:
Use Grep to search for hardcoded secrets:
Patterns to search:
- SUPABASE_.*KEY
- OPENAI_API_KEY
- AWS_(ACCESS|SECRET)
- STRIPE_(SECRET|PUBLISHABLE)_KEY
- DATABASE_URL
- PRIVATE_KEY
- -----BEGIN.*PRIVATE KEY-----
- gh[pousr]_[A-Za-z0-9]{36,}
- sk-[A-Za-z0-9]{48}
Check if .env files are tracked in git:
git ls-files | grep -E '\.env($|\.)'
Check for NEXT_PUBLIC_ vars that shouldn't be public.
If supabase/ folder exists:
supabase/migrations/USING (true) or WITH CHECK (true)supabase/config.toml for auth settingsOffer browser check if Claude Chrome extension available.
Scan API routes:
app/api/**/route.ts (App Router)pages/api/**/*.ts (Pages Router)Flag routes missing:
getServerSession / auth() callsNextAuth middlewareRun npm audit:
npm audit --json 2>/dev/null
Parse and categorize by severity.
Create VIBE_CHECK.md at project root with:
# Security Audit Report
Generated: [date] | vibe-check v1.0.0
## Summary
| Severity | Count |
|----------|-------|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |
## Deploy Readiness: X/100
## Findings
[List each finding with severity, file, issue, risk, and fix]
| Level | Criteria |
|---|---|
| Critical | Exposed prod secrets, no auth on sensitive endpoints |
| High | Missing RLS, auth bypass possible |
| Medium | Weak patterns, potential issues |
| Low | Best practice violations |
VIBE_CHECK.md report file