I built vibe-shield because I kept seeing the same problem: people are shipping real products with AI coding tools, and they're moving so fast that basic security issues slip through - hardcoded API keys, raw SQL queries, innerHTML with user data. The thing is, the developers using Cursor and Claude Code aren't always security experts. And the non-developers building with these tools definitely aren't. There was no lightweight way to say "hey, check your code for obvious security holes" without asking them to learn a whole security toolchain. So I made it stupid simple: run npx vibe-shield and you get a list of issues with fix instructions that you can paste right back into your AI agent. The AI wrote the bug, the AI fixes the bug - you just need something in between to catch it. It started as a basic scanner, but I quickly realized the real value was in the output format. Instead of just flagging issues, it generates structured prompts like [TASK 1] Fix Hardcoded Secret in src/db.ts at line 12 with step-by-step instructions. That way Cursor or Claude Code can follow them without you needing to understand the fix yourself. Since then I've added pre-commit hooks (so bad code never gets committed) and an MCP server (so your AI tool can run security checks automatically before marking a task as done). Would love to hear what security checks you'd want to see added - this is open source and built for the community. 🛡️

Vibe Shield

One command to find security holes in AI-generated code

One command to find security holes in AI-generated code