A 20-minute first-pass security triage of a small web app, with the worst issues first and a fix for each.
Runs a time-boxed pass over secrets, access control, API surface and dependencies using the four specialist checklists, confirms each issue in the source and returns a prioritised list with file:line, proof and fix.
6 skills · 2 MCP servers · 5 settings
Vibe App Security Triage is the first thing to run on an app you built fast and want to put in front of real users. In about twenty minutes it goes through the four areas where AI-assisted apps most often go wrong: leaked secrets, missing access control (Supabase RLS, API routes without checks, ids trusted from the URL), an unguarded API surface (no validation, no rate limits, loose CORS, unsigned webhooks) and risky dependencies.
It does not try to be complete. It confirms each issue in the source, ranks them by what an attacker would do first, and gives a fix with an effort estimate so you can spend the next hour well. It ends with a verdict (do not ship, fix before launch, ship with follow-ups, looks ok) and the list of what it did not have time to check, so you know what the deeper agents should do next.
It reads files only. Give it the app root and one paragraph about what the app does and who uses it; the ranking depends on that.