vibe-check
A security checklist and scanner for AI-generated web apps, combining an AI rules file, an automated external scan, and an AI-run audit prompt with a manual checklist.
vibe-check is a security toolkit aimed at applications built largely with AI coding assistants. It has four parts: an AGENTS.md rules file that an AI coding tool reads while writing code to prevent common vulnerabilities; a Python scanner that checks a running app from the outside for issues such as exposed .env or .git files, public source maps, missing security headers, CORS misconfiguration, and unsafe cookie flags; an AI-checklist prompt that has an AI tool audit the whole codebase, write reports, and implement and verify fixes; and a manual checklist for issues an AI cannot catch on its own.
The scanner sends about seventy read-only requests per site and prints a pass, fail, or warning with a suggested fix for each check, with a machine-readable JSON output option; it is meant to be run against a deployed URL rather than only localhost, since many issues come from a host or CDN rather than application code.
It is installed by copying files from a git clone into a target project, and is written in Python.