Security Layer

Security Layer

This group exists because vibe-coded apps — built fast with AI assistance, Cursor, Lovable, v0, or similar tools — ship features quickly but often skip security fundamentals. The AI generates plausible-looking code that compiles and runs, but frequently:

• Skips input validation
• Exposes secrets or stack traces in responses
• Has no rate limiting
• Uses localStorage for JWTs
• Has broken authorization (auth ≠ authorization — authenticated doesn't mean authorized)
• Ships with dangerouslySetInnerHTML and no sanitization
• Has GitHub Actions workflows vulnerable to expression injection

This layer treats all vibe-coded code as untrusted until proven otherwise.

When activated: identify the right sub-skill, load it, follow its workflow. Do not pattern-match and flag — investigate first, then report only high-confidence findings.

Skill Map

Full Security Review (Start Here for Most Cases)

• security-review — OWASP-aligned vulnerability audit with confidence levels. Covers injection, XSS, CSRF, auth/authz, secrets, cryptography, SSRF, business logic, deserialization, misconfiguration, supply chain, logging. Distinguishes attacker-controlled vs server-controlled inputs. Reports only HIGH confidence findings. Use this for any pre-launch or pre-shipping audit of Antibody, SchoolOrder, or any new feature.
  • Located at /mnt/skills/user/security-review/SKILL.md
  • Upgraded version from skills-main at security-layer/references/security-review-v2.md

Code-Level Bug and Vulnerability Scanning

• find-bugs — branch-diff scanner. Maps the full attack surface of changed files (inputs, queries, auth checks, external calls, crypto), runs a structured security checklist, and reports per file. Use this after finishing a feature branch before merging — catches what AI missed.
  • Located at security-layer/references/find-bugs.md

GitHub Actions / CI Security

• gha-security-review — GitHub Actions workflow auditor. Finds pwn-request attacks, expression injection, credential theft, supply chain risks in .github/workflows/. Every finding requires a full PoC — no theoretical issues. Use this when setting up or modifying CI/CD for any project. Critical for Antibody which will handle sensitive financial data.
  • Located at security-layer/references/gha-security-review.md

Code Quality + Security Review (PR-level)

• code-review — Sentry-style review covering runtime errors, N+1s, performance, backwards compatibility, security gaps, test coverage. More holistic than a pure security pass. Use when reviewing a full PR or module rather than a targeted vulnerability hunt.
  • Located at security-layer/references/code-review.md

Vibe-Coded App Fast Audit (Quick Mode)

When someone says "just check if this is safe" or "I vibe coded this, is it cooked?" — run this checklist mentally across the codebase before loading any sub-skill:

If 3+ of these fail → run full security-review. If it's a diff → run find-bugs. If it's CI → run gha-security-review.

How to Use

1. Classify the request using the table below, then load the matching sub-skill.
2. Never pattern-match and flag — investigate data flow first.
3. Report only high-confidence findings — a false positive wastes dev time and erodes trust in the audit.
4. For vibe-coded apps with no clear entry point: start with the Fast Audit checklist above, then escalate to full security-review.

Vibe-Coded App Red Flags (Auto-Escalate These)

These patterns in AI-generated code almost always need immediate attention:

// Red flag 1: JWT in localStorage (XSS risk)
localStorage.setItem('token', response.token)

// Red flag 2: No ownership check (IDOR)
const order = await db.orders.findUnique({ where: { id: orderId } })
// Missing: where: { id: orderId, userId: session.user.id }

// Red flag 3: Raw user input in queries
const results = await db.query(`SELECT * FROM users WHERE name = '${req.body.name}'`)

// Red flag 4: Stack trace in error response
catch (e) { res.json({ error: e.message, stack: e.stack }) }

// Red flag 5: Hardcoded secret
const stripeKey = "sk_live_abc123..."

// Red flag 6: dangerouslySetInnerHTML without sanitization
<div dangerouslySetInnerHTML={{ __html: userPost.content }} />

// Red flag 7: No rate limiting on auth endpoint
app.post('/api/auth/login', async (req, res) => { ... })

// Red flag 8: CORS wildcard with credentials
res.header('Access-Control-Allow-Origin', '*')
res.header('Access-Control-Allow-Credentials', 'true')

Severity Scale

Non-Negotiables for Seb's Apps

These apply to Antibody and SchoolOrder without exception:

• No hardcoded secrets. Ever. Not even for "quick testing."
• RLS on every Supabase table. Enable before writing policies, not after.
• Zod schema on every API route input. AI-generated routes skip this. Always add it.
• httpOnly cookies for auth tokens. Not localStorage, not sessionStorage.
• Rate limiting on auth and search endpoints. Vercel KV or upstash/ratelimit.
• Generic error messages to users. Full errors only in server logs.
• Supabase service role key server-side only. Never in browser context.
• Antibody specifically: any endpoint that handles transaction data or fraud signals needs auth + authz + rate limiting + audit logging. All four. No exceptions.

Reference Files