Vibe Code Security Reviewer

View saved version →

---
name: ai-application-security
description: Review AI features for prompt injection, data leakage, tool abuse, unsafe output, and excessive agency.
---

# AI Application Security

Map untrusted content, system instructions, retrieval, tools, model outputs, and side effects. Check prompt injection, indirect injection, sensitive-data leakage, insecure tool permissions, output validation, cross-user context, logging, rate limits, and human approval for high-impact actions.

View saved version →

---
name: api-abuse-and-misuse
description: Review APIs for broken object authorization, excessive data, unsafe methods, rate-limit gaps, and abuse paths.
---

# API Abuse and Misuse

Trace every sensitive endpoint from request to authorization, query, mutation, and response. Check BOLA/IDOR, mass assignment, over-broad selects, enumeration, pagination abuse, replay, missing idempotency, rate limits, quota bypass, unsafe webhooks, CORS, error leakage, and privilege escalation. Ensure controls are enforced server-side and test negative cases for another user, tenant, role, and unauthenticated caller.

View saved version →

---
name: api-leak-and-key-security
description: Detect API keys, service credentials, tokens, and privileged endpoints leaked to clients or repositories.
---

# API Leak and Key Security

Search source, history, bundles, source maps, logs, error responses, CI output, previews, browser storage, and configuration for secrets. Treat `NEXT_PUBLIC_*`, `VITE_*`, `PUBLIC_*`, client-exposed environment variables, and frontend bundles as public. Never expose Supabase `service_role`, secret keys, database passwords, signing keys, or provider secrets. Report location and rotation need without reproducing values.

Verify server/client boundaries, secret injection, redaction, rotation, least privilege, environment separation, and whether a leaked key remains usable after removal from source.

View saved version →

---
name: authentication-and-authorization
description: Review login, sessions, tokens, roles, permissions, tenant isolation, and privileged actions.
---

# Authentication and Authorization

Check identity proofing, password or OAuth flows, session lifecycle, token storage, expiry, refresh, logout, CSRF, MFA, role checks, object-level authorization, tenant boundaries, admin paths, and account recovery. Verify authorization on the server for every sensitive operation.

View saved version →

---
name: cloudflare-and-deployment-security
description: Review Workers, Pages, storage bindings, deployment configuration, and production security controls.
---

# Cloudflare and Deployment Security

Check bindings, secrets, routes, preview exposure, CORS, cache behavior, Durable Object or database access, R2 uploads, service bindings, logs, environment separation, migrations, rollback, and least privilege. Treat deployment configuration as security-sensitive code.

View saved version →

---
name: dependencies-and-supply-chain
description: Review packages, lockfiles, scripts, provenance, licensing, advisories, and dependency risk.
---

# Dependencies and Supply Chain

Check direct and transitive dependencies, versions, lockfiles, install scripts, abandoned packages, advisories, typosquatting signals, permissions, licenses, and update paths. Prioritize reachable vulnerable code and verify fixes with reproducible installs.

View saved version →

---
name: edge-functions-and-webhooks
description: Review serverless functions, webhooks, signatures, retries, idempotency, and privileged execution.
---

# Edge Functions and Webhooks

Check authentication, signature verification, replay protection, input validation, timeouts, retries, idempotency, secret handling, response leakage, outbound allowlists, and privileged database clients. Ensure failures cannot trigger duplicate side effects or silently bypass authorization.

View saved version →

---
name: observability-and-incident-response
description: Review security logging, alerting, audit trails, containment, recovery, and post-incident evidence.
---

# Observability and Incident Response

Check whether security-relevant events are logged with actor, target, result, request ID, and timestamp without exposing secrets or personal data. Review alert thresholds, retention, tamper resistance, access, key rotation, containment, rollback, recovery, and post-incident learning.

View saved version →

---
name: postgres-database-security
description: Review PostgreSQL schemas, grants, functions, views, migrations, and query safety.
---

# PostgreSQL Database Security

Check roles, grants, default privileges, exposed schemas, RLS, functions, search paths, dynamic SQL, injection, migrations, backups, extensions, sensitive columns, and overly broad service access. Treat database authorization as independent defense in depth rather than relying only on frontend checks.

View saved version →

---
name: privacy-and-data-governance
description: Review collection, minimization, retention, consent, logging, export, deletion, and third-party data flows.
---

# Privacy and Data Governance

Map personal and sensitive data from collection through storage, logs, analytics, vendors, backups, export, and deletion. Check minimization, retention, access, consent, user rights, tenant isolation, redaction, and policy consistency. Do not claim legal compliance; report technical gaps for qualified review.

View saved version →

---
name: realtime-and-messaging-security
description: Review realtime channels, WebSockets, queues, broadcasts, subscriptions, and message authorization.
---

# Realtime and Messaging Security

Check channel authorization, tenant isolation, subscription validation, message size, sender permissions, replay, ordering, rate limits, queue visibility, dead-letter data, and disconnect behavior. Never trust a client-provided channel or recipient.

View saved version →

---
name: secrets-and-data-protection
description: Find exposed secrets and review sensitive-data collection, storage, logging, and transmission.
---

# Secrets and Data Protection

Check hard-coded credentials, leaked environment values, client bundles, logs, analytics, backups, database access, encryption, retention, redaction, and least privilege. Never print secret values. Recommend rotation, scope reduction, and safe verification.

View saved version →

---
name: security-review-reporting
description: Produce concise, evidence-backed security reports for developers and stakeholders.
---

# Security Review Reporting

Start with scope and executive risk summary. Use a table with ID, severity, confidence, affected path, impact, evidence, remediation, and verification. Include positive controls, limitations, assumptions, and prioritized next steps. Never call a review a certification or guarantee.

View saved version →

---
name: security-testing-and-remediation
description: Convert findings into safe tests, prioritized fixes, regression coverage, and verification evidence.
---

# Security Testing and Remediation

For each finding, define a non-destructive reproduction or test, expected secure behavior, smallest fix, regression test, and recheck. Prefer local fixtures and authorized test environments. Report what was tested, what was not, and residual risk.

View saved version →

---
name: storage-and-upload-security
description: Review object storage, file uploads, MIME validation, path ownership, malware risk, and download authorization.
---

# Storage and Upload Security

Check file size, type, content validation, names, paths, overwrite behavior, ownership, bucket visibility, signed URL expiry, download authorization, metadata, decompression, and virus or abuse handling. For Supabase Storage, review object policies and remember upsert requires the relevant insert, select, and update permissions.

View saved version →

---
name: supabase-auth-and-sessions
description: Review Supabase Auth identity, JWT claims, sessions, recovery, OAuth, and account lifecycle security.
---

# Supabase Auth and Sessions

Check SSR client usage, `getUser` versus untrusted session assumptions, cookie flags, token expiry and refresh, logout, recovery, OAuth redirect allowlists, email verification, MFA, anonymous users, user deletion, stale JWT claims, and session revocation. Never use user-editable metadata for authorization. For strict revocation requirements, validate the session lifecycle on sensitive operations.

View saved version →

---
name: supabase-rls-security
description: Perform deep Supabase Row Level Security, Data API exposure, policy, view, function, and role analysis.
---

# Supabase RLS Security

Use for any Supabase database, Auth, Data API, Storage, view, function, or user-data review.

## Mandatory checks

- Enable RLS on every table in exposed schemas, including `public` by default.
- Confirm Data API exposure and explicit grants separately from row policies.
- Check every table's `SELECT`, `INSERT`, `UPDATE`, and `DELETE` model.
- For `UPDATE`, verify both `USING` and `WITH CHECK`; also verify the required `SELECT` policy.
- Reject `TO authenticated` without an ownership, membership, tenant, or capability predicate.
- Prefer `TO authenticated` or `TO anon` clauses; flag deprecated `auth.role()` checks.
- Never use user-editable `raw_user_meta_data` for authorization; use trusted server-controlled app metadata or database membership tables.
- Review views for `security_invoker = true` on supported Postgres versions or restricted access in an unexposed schema.
- Review `SECURITY DEFINER` functions for schema placement, explicit authorization, fixed search path, minimal grants, and default `PUBLIC` execute privileges.
- Check storage policies, including `SELECT`, `INSERT`, and `UPDATE` for upsert behavior.
- Review service-role usage and ensure it never reaches public clients.

## Findings format

Report table/schema, exposed role, operation, policy, predicate, bypass path, impact, and a safe SQL or application-level remediation. Never invent a policy without understanding the intended access model.

View saved version →

---
name: threat-modeling
description: Model assets, actors, trust boundaries, attack paths, and mitigations for an application.
---

# Threat Modeling

Inventory assets and sensitive operations, actors and privilege levels, entry points, trust boundaries, data flows, abuse cases, and security assumptions. Prioritize realistic threats and connect each mitigation to a verification method.

View saved version →

---
name: vibe-code-security-reviewer
description: Route fast-built application reviews into focused threat, code, dependency, data, deployment, and remediation workflows.
---

# Vibe Code Security Reviewer

Use this plugin to review AI-generated, low-code, prototype, and production application code for security weaknesses.

## Review workflow

1. Establish scope: repository, routes, APIs, identities, data, deployment, external services, and environment.
2. Identify trust boundaries and attacker-controlled inputs.
3. Trace authentication, authorization, data access, mutations, uploads, outbound requests, and privileged operations.
4. Route to focused skills under `skills/`.
5. Report findings with severity, confidence, affected path, exploit preconditions, impact, evidence, fix, and verification test.
6. Separate confirmed findings from hypotheses and missing evidence.
7. Re-review the exact changed path after remediation.

Always run the API leak, authentication, and data-access checks for any application that exposes a client-side API or database. For Supabase projects, always run the Supabase RLS and Supabase API checks together; RLS alone does not determine whether a table or function is exposed through the Data API.

## Severity

Use practical severity based on exploitability, impact, exposure, privilege required, affected users, and compensating controls. Do not inflate every issue to critical. Call out attack chains when individually medium findings combine into serious risk.

## Boundaries

- Review defensively and only within the user's authorized scope.
- Do not exploit real systems, exfiltrate data, bypass controls, or create persistence.
- Never expose secrets found in code; report location and rotation need without reproducing values.
- Do not claim a clean security audit from a limited review.

View saved version →

---
name: web-application-security
description: Review web applications for injection, XSS, CSRF, SSRF, unsafe redirects, uploads, and browser security weaknesses.
---

# Web Application Security

Trace untrusted input to SQL, shell, templates, HTML, URLs, file paths, parsers, and outbound requests. Check output encoding, validation, same-origin protections, upload type and size, path traversal, SSRF allowlists, security headers, and safe error handling.