VibeDefend by CybeDefend - The one command line to secure your Cursor and Claude Code

What is the main risk keeping your team from giving full autonomy to AI coding agents right now?

fun fact: 81% of the community is a 'human-in-the-loop' type of developer, according to this thread.

@axel_paulin i think the main concern for us is data leakage and accidental secret exposures when agents auto-commit. best of luck for launch

@cybedefend  @florentin_ledy If this actually works as seamlessly as describe it’s a total game changer for our workflow. congrats team for second launch🙌

@matheus_paranhos1 Hey Matheus, thanks a lot for the support! 🙌

Integration is actually designed to be super straightforward. You can check out the step-by-step guides for different environments right here in our documentation: https://docs.cybedefend.com/latest/api-reference/introduction

To point you in the exact right direction, I'd love to know a bit more about your current setup!
Let me know, I'd be happy to walk you through how it would fit perfectly into your workflow! 🚀

@jackthompson68 Yes, in two ways:

1. Files the agent edits directly are scanned at the end of the session.

2. If the agent commits during the session, the scan also covers the full git diff of those commits, so files generated or modified indirectly (codegen, scripts, shell commands) are included too.

Upstream, the secret guard also blocks the agent from reading raw secrets (like .env files) and points it to the managed reference instead, so secrets are much less likely to end up in generated code in the first place.

Anything not committed during the session gets picked up by your regular CybeDefend scans (CI or repo) as soon as it lands in the codebase.

@jackthompson68 Good question. Two layers, upstream, the guard refuses the read of .env or of a secret in the first place, so it never enters the agent's context and can't be copied into a generated file. Then the end-of-session scan covers what the session changed like Florentin explained. The hook layer, what fires on each tool call and at session end, is described here: docs.cybedefend.com/latest/agent-ai-integration/vibedefend

The State of Vibe Coding 2025 report [1] highlighted 3 types of vulnerabilities: exposing secrets, access misconfigurations, hardcoded credentials. Do you share this opinion? or have you found more patterns based your user interviews and research?

[1] The State of Vibe Coding 2025 in /p/vibecoding

@devinstone Great question! Rules come from two sources, and your team stays in control of both.

1. At the first scan, our miner analyzes the repo and extracts the most consistent coding conventions and business rules, so the agent starts with a solid corpus from day one.

2. Then the corpus keeps growing as you code. When a business rule emerges during a session, either because the agent realized it made a mistake or because you corrected it, it can propose that rule at the end of the session. Your rule base gets enriched automatically, session after session.

On the control side:

Session proposals are never applied silently: they land in a review inbox and your team accepts or rejects each one. By default, the agent even asks you in chat before drafting one.

Curious to hear how your team manages these rules today!

@devinstone Adding one important point, because it's the part teams ask about most, what you can do with the rules once they exist. Every rule lives in the VibeDefend tab of your project dashboard, as a plain sentence you can read, edit, rewrite or delete. A new rule always lands as a proposal first, whether it was mined at the first scan or suggested after a session, and the people in charge of the project decide which ones go active. Once active, a rule applies to every agent and every developer connected to that project, Claude Code, Cursor or Copilot alike, so there is one rule base and not one file per person to summarize, mining gives you the starting point, the review is where the team makes it theirs. The proposals inbox and the end-of-session gap analysis are documented here: docs.cybedefend.com/latest/agent-ai-integration/vibedefend, and there's a longer piece on giving the agent business context rather than conventions: cybedefend.com/en/blog/how-to-give-claude-code-context

@devinstone curious: how do you currently manage your business and security rules with your team?

@john_michael31 Yes, absolutely! VibeDefend ships with default presets across 5 categories: Filesystem, Shell & commands, Network, Git and Process. They block the most dangerous actions and warn on unusual behavior, which also acts as a safety net if the agent ever gets hijacked (prompt injection, poisoned context...).

From there, everything is configurable:

1. Switch any preset between warn and block, or disable it entirely.

2. Create your own blocking rules directly in the VibeDefend tab of your project, to match your internal security policies.

3. Rules live at the project level, so every AI agent working on that project gets the same policy.

You can cover file reads and writes, deletions, privileged actions like sudo, package installs, destructive Terraform actions, specific processes, git operations, HTTP and network calls, access to specific environment variables, and more.

Happy to walk you through it if you have a specific policy in mind!

@john_michael31 Florentin has the config covered, so a different angle. Blocking rm -rf is the floor, every team should have it and it takes a minute. The part that changed how our users work is that the same project policy carries the business rules too, and every agent on the project gets it, Claude Code, Cursor, Copilot, whichever a developer prefers.

One policy, mined once from the repo, served at the edit. Otherwise you end up with a CLAUDE.md here, a .cursorrules there, and three versions of the truth.. The guards are documented here: docs.cybedefend.com/latest/agent-ai-integration/vibedefend, and if your team runs Claude Code with --dangerously-skip-permissions, this explains what that flag skips and what still blocks: cybedefend.com/en/blog/claude-code-dangerously-skip-permissions-explained

@louis_goudal Thank you so much! 🙏

Yes, it's a single command:

npx -y @cybedefend/vibedefend@latest install

The installer walks you through it: pick your region (EU or US), sign in, and it auto-detects the agents you have installed (Claude Code, Cursor, Codex, Windsurf, VS Code Copilot) and wires them up. It works on macOS, Linux and Windows.

You can try it for free, no credit card required. Let me know how it goes!

@louis_goudal  It installs on the agent and not on the project, with one npx command, then you link a repo by dropping its project id in a small config file at the root. The docs walk through it: docs.cybedefend.com/latest/agent-ai-integration/vibedefend

@albertnelson Yes! At the end of the session or when he finished part of the deliverable before the pull request, VibeDefend runs a scan on the agent's work. It runs in the background, so the agent can keep going and gets notified as soon as the scan is done, then fixes the findings in the same session.

The scan only covers the files the agent modified, so it's very fast and focused on the work it just did. For example, if it introduces a SQL injection, it gets the finding and switches to a parameterized query before you even commit.

The result: far fewer alerts further down the pipeline.

@albertnelson One other thing on what that feedback actually contains, because it's where we spend our energy. A SQL injection is the easy part, every scanner catches it. 43% of API vulnerabilities exploit business logic, not a CVE (Wallarm, 2026), and no scanner sees that a refund above 500 euros needs a finance manager.

So the rules are mined from your repo at the first scan, then served to the agent right before it writes the feature the developer asked for, the right rule at the right moment in the right file. We measured the difference on tickets with the same model, and the whole study is public: github.com/CybeDefend/vibedefend-xp. More on why scanners are blind to this: cybedefend.com/en/blog/business-logic-flaws-ai-generated-code

@albertnelson thanks for the support! curious what's your stack btw? anything your coding agents did that scared you lately? ping ?makers