VibeSec

VibeSec is the market-facing launch-audit product for AI-built apps.

Quick Start

# Install VibeSec globally
npm install -g vibesec

# Set up hooks for your coding harness (auto-detects Claude Code, Pi, or git)
vibesec setup

# Run a security scan
vibesec scan .

# Run a launch-readiness audit
vibesec audit . --profile ai-web-app

# Run with codebase context enrichment
vibesec audit . --profile ai-web-app --with-context

Installation & Setup

Automatic Setup (Recommended)

# Auto-detect harness and install hooks
vibesec setup

# Or specify harness explicitly
vibesec setup --harness claude    # Claude Code
vibesec setup --harness pi        # Pi
vibesec setup --harness git       # Git pre-commit hook

This installs:

• Pre-commit hook: Scans staged files before git commit (blocks on critical findings)
• Post-edit hook: Scans files after edits (warns on high+ findings)

Hooks run automatically during development, catching vulnerabilities as they're introduced.

Manual Installation

If you prefer manual installation:

# Install globally
npm install -g vibesec

# Copy skill for coding agents
cp -r node_modules/vibesec/skills/vibesec ~/.claude/skills/  # Claude Code
cp -r node_modules/vibesec/skills/vibesec ~/.pi/agent/skills/  # Pi

Commands

Security Scan

# Quick scan (all severities)
vibesec scan .

# Scan with severity filter
vibesec scan . --severity high

# JSON output (machine-readable)
vibesec scan . --format json

# Scan specific files
vibesec scan src/api/*.ts

Launch-Readiness Audit

# Full audit with AI web app profile
vibesec audit . --profile ai-web-app

# With codebase context enrichment
vibesec audit . --profile ai-web-app --with-context

# JSON output for CI/CD
vibesec audit . --profile ai-web-app --format json

# Save report to file
vibesec audit . -f json -o audit-report.json

Exit Codes

• 0 — Clean (no findings)
• 1 — Findings detected
• 2 — Error (bad args, config, runtime failure)

Hook System

VibeSec integrates with coding agents via hooks that run automatically during development.

Pre-Commit Hook

Scans staged files before git commit. Blocks commits with critical findings.

Behavior:

• Runs vibesec scan --staged --severity critical
• If critical findings: blocks commit, shows fix suggestions
• If clean: allows commit

Bypass: git commit --no-verify (not recommended)

Post-Edit Hook

Scans files after edits. Warns agent of vulnerabilities.

Behavior:

• Runs vibesec scan <file> --severity high
• If findings: shows AI fix prompts for each vulnerability
• Agent can apply fixes before continuing

Hook Configuration

Hooks are configured in:

• Claude Code: .claude/hooks/vibesec.json
• Pi: .pi/hooks/vibesec.json
• Git: .git/hooks/pre-commit

See hooks/README.md for detailed hook documentation and customization.

JSON Output Contract

All commands with --format json produce a structured envelope:

{
  "version": "1.0.0",
  "command": "scan",
  "exitCode": 1,
  "timestamp": "2026-06-08T...",
  "data": {
    "findings": [...],
    "summary": { "total": 3, "critical": 1, "high": 2 },
    "scan": { "path": ".", "filesScanned": 42 }
  },
  "error": null
}

stdout/stderr separation:

• stdout: Single valid JSON document (for machine parsing)
• stderr: Progress indicators, summaries, warnings (for humans)

Schema: https://vibesec.dev/schemas/cli-output/v1.json

Integration Patterns

CI/CD Pipeline

# .github/workflows/security.yml
name: Security Audit
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm install -g vibesec
      - run: vibesec audit . --profile ai-web-app --format json > audit.json
        continue-on-error: true
      - run: |
          EXIT_CODE=$?
          if [ $EXIT_CODE -eq 1 ]; then
            echo "::error::Security audit found vulnerabilities"
            exit 1
          fi

Package.json Scripts

{
  "scripts": {
    "security:scan": "vibesec scan . --format json",
    "security:audit": "vibesec audit . --profile ai-web-app --format json",
    "security:fix": "vibesec audit . --profile ai-web-app --format json | jq -r '.data.findings[].aiFixPrompts[0].prompt'"
  }
}

Coding Agent Workflow

1. Agent edits a file
2. Post-edit hook fires, scans the file
3. If findings: agent reads aiFixPrompts[0].prompt and applies fix
4. Agent commits changes
5. Pre-commit hook fires, scans staged files
6. If critical findings: commit blocked, agent fixes and retries
7. If clean: commit succeeds

Skill for Coding Agents

VibeSec includes a skill definition (skills/vibesec/SKILL.md) that coding agents can load to understand:

• When to run security scans
• How to interpret JSON output
• How to apply AI fix prompts
• Integration patterns for different harnesses

The skill is automatically available after vibesec setup or manual installation.

Rules & Profiles

Default Rules

VibeSec ships with rules for:

• secrets — Hardcoded API keys, tokens, passwords
• injection — SQL injection, command injection, path traversal
• auth — Missing auth checks, role validation, session handling
• web-security — CORS, CSRF, XSS, webhook signature verification
• ai-specific — Prompt injection, unsafe LLM calls, missing input validation
• incomplete — TODO/FIXME/HACK markers, stub implementations

Audit Profiles

• ai-web-app — Next.js, React, Supabase, Stripe, Clerk stacks (default)

Profiles define which rules to run and how to weight findings for launch-readiness scoring.

Severity Levels

• critical — Immediate security risk, blocks deployment
• high — Significant vulnerability, fix before release
• medium — Potential issue, fix in next sprint
• low — Best practice improvement, fix when convenient

Development

# Install dependencies
bun install

# Run typecheck
bun run typecheck

# Run tests
bun run test

# Run scan
bun run scan .

# Run audit
bun run audit . --profile ai-web-app

# Build
bun run build

Architecture

VibeSec uses a CLI+JSON-first architecture:

• CLI is the primary interface for humans, CI/CD, and AI agents
• JSON output is machine-parseable with structured envelopes
• MCP server is a thin subprocess shim (~150 lines) that spawns CLI
• Conexus integration enriches findings with codebase context via CLI adapter

This design ensures:

• Works everywhere: terminal, CI/CD, coding agents
• No race conditions or DB locking issues
• Clean separation between CLI and MCP
• Easy to extend and maintain

Documentation

• skills/vibesec/SKILL.md — Skill definition for coding agents
• hooks/README.md — Hook system documentation
• docs/architecture/ — Architecture decision records
• docs/guides/ — How to run and sell launch audits
• examples/ — Vulnerable demo app and sample reports

Paid Launch Audits

Shipping an AI-built app for a client?

VibeSec Launch Audit gives you a launch-readiness report, prioritized security findings, AI-ready fix prompts, and one retest after fixes.

Founding audits: $99.

Market-validation next step: sell 3 founding VibeSec Launch Audits before building a SaaS dashboard.

License

MIT