Swipe right for a newer agent, Patch Notes Explainer. Swipe left for an older agent, Meeting Notes to Tasks.
Issue 37 · 11 Oct 2026 · Medium · Free
Vibe-code Security Checker
The model shipped a feature in one shot. It runs. You still need someone to ask where the password is stored and who is allowed to delete the row.
A review prompt for vibe-coded diffs. It hunts secrets, missing auth, injection, and insecure defaults, then names the fix.
- Category
- Coding & Vibe Coding
- Runs in
- Cursor
- Claude
- ChatGPT
What you put in and what you get out
Sample you can paste
Stack: Next.js route handler, TypeScript, Postgres via a query string.
Diff:
```ts
export async function DELETE(request: Request) {
const { id } = await request.json();
const key = "sk_live_51HabcExampleNotReal";
await db.query("delete from notes where id = " + id);
return Response.json({ ok: true, key });
}
```Share this agent
Vibe-code Security Checker — You put in Stack: Next.js route handler, TypeScript, Postgres via a query string.. You get out What it will not do. Free from One Agent a Day.
30-second demo
0:00
The diff that 'works'
A Next.js DELETE handler reads an id from JSON, concatenates it into SQL, and returns a live-looking secret key in the response.
How it works
Vibe-coding gets a feature on screen and leaves the boring failures in the diff: a key in the file, a query built with string concatenation, a delete route that trusts the body's userId, a price checked only in the browser.
This agent walks a fixed rubric and reports findings against the diff you paste. It is a review, not an attack tool. The prompt tells the model to describe the impact and show a safer version of *your* code. It refuses exploit steps, payloads, and proof-of-concept attacks.
Use it on the diff you are about to merge
Paste the prompt once as a standing instruction. Each review is then: stack in one line, diff in a fence, done. If you use Cursor, a project rule means you can say "review this diff with the security checker" and the rubric is already there.
The JSON file is the same rubric in an order a script can read later. The prompt stands alone if you only want to paste one thing.
A finding without a file and a quoted line is a feeling. The output format rejects those.
Use it
Step 1
Save the prompt where you write code
In Cursor, add the prompt as a project rule or paste it at the start of a review chat. In Claude or ChatGPT, save it as a project instruction. The rubric JSON can sit beside it.
Step 2
Paste a diff, not the whole repo
Include the files that changed and one line about the stack: framework, database, and whether the route is public. A 200-line diff reviews better than a zip file.
Step 3
Read findings before fixes
The agent lists issues first, with severity and the line that triggered them. It shows a safer version of your code. It does not write an exploit.
Step 4
Treat it as a first pass
This does not replace a human review, a dependency audit, or a pentest. It catches the class of mistake vibe-coding produces on a Tuesday night.
Prompt
vibe-code-security-checker.prompt.txt
You review AI-generated or hastily written code for security issues. You are a careful reviewer, not an attacker. You never provide exploit steps, payloads, proof-of-concept attacks, or instructions for breaking a system you were not given. You only inspect the code the user pasted.
INPUT
- One line on the stack: language, framework, datastore, and how a user authenticates, if they said.
- A diff or a file. If they paste a whole repo with no question, review the routes, queries, and auth checks first.
- If they did not include auth context, say what you had to assume.
RUBRIC, in this order
1. Secrets: keys, passwords, tokens, or connection strings in source, logs, or client responses.
2. Authorization: can a caller read or change someone else's data by changing an id? Is the user id taken from the client?
3. Injection: SQL, shell, HTML, path, or header values built by concatenation.
4. Browser trust: prices, roles, or feature flags decided only on the client.
5. SSRF and open fetches: user-controlled URLs requested by the server.
6. Auth defaults: missing rate limits on login or reset, cookies without sensible flags, debug routes left on.
7. LLM calls: untrusted text concatenated into a tool-using prompt, with no boundary between instructions and data.
RULES
- Quote the line you are talking about. No finding without evidence from the paste.
- Severity is only: high, medium, low.
- For each finding, say the impact in one sentence and show a safer version of their code. Do not show attack traffic.
- If the paste includes a live-looking secret, tell them to rotate it. Do not repeat the full secret in your answer; redact the middle.
- Do not claim a clean bill of health. End with what you could not see (dependencies, infra, data migrations).
- If the user asks for an exploit, refuse that part and continue the review.
OUTPUT
## Findings
A list. Each item: severity, title, quoted evidence, impact, safer code.
If there are none, write "No findings in the pasted code" and still complete the next section.
## Not visible from this diff
Bullets of what you could not check.
## Do these first
The high findings, in order, as actions. If there are no high findings, say so.Config
security-review.rubric.json
{
"version": 1,
"refuses": [
"exploit steps",
"payloads",
"proof of concept attacks"
],
"order": [
"secrets",
"authorization",
"injection",
"client-trusted decisions",
"server-side requests",
"auth defaults",
"prompt boundaries"
],
"severities": [
"high",
"medium",
"low"
],
"requiresEvidenceQuote": true
}
Related agents
Swipe sideways
Coding & Vibe Coding15 Oct 2026 · #41Session HandoffPaste the mess from a coding session. Get a handoff note: what shipped, what is broken, and the exact prompt to paste tomorrow.InBranch: feat/billing-uiOutTomorrow's first promptEasy Preview this drop
- 0:00 The swampBranch feat/billing-ui. Auth works. Billing page half done. Stripe webhook returns 400. Receipt email never fires.
- 0:08 What actually shippedLogin on staging, pricing table render, stripe package installed. Plan change is still a stub. PayPal left alone on purpose.
- 0:16 What is brokenWebhook 400, missing signature check, BillingForm customerId null, receipt email not wired. Ranked by what blocks the rest.
- 0:24 Tomorrow's first promptA paste-ready prompt that starts at the webhook 400, forbids touching PayPal, and asks for a signature check plus a failing test.
No daily video for this drop yet. The in and out lines above are the preview.
Coding & Vibe Coding29 Sep 2026 · #25Env Var AuditorPaste .env.example and the code that reads it. Get missing keys, unused keys, and names that look like live secrets.In.env.exampleOutThe fixMedium Preview this drop
- 0:00 The driftPORT and DATABASE_URL are read. DATABASE_URL is required. FLY_REGION is read and missing from the example.
- 0:08 UnusedNothing in the example is unread. FLY_REGION is the gap, the other way.
- 0:16 The live-looking valueSTRIPE_SECRET_KEY's example starts with sk_live_. That prefix does not belong in an example even if they say it is fake.
- 0:24 The fixAdd FLY_REGION=local. Change the Stripe example to a sk_test_ placeholder. Do not print a real key.
No daily video for this drop yet. The in and out lines above are the preview.
Coding & Vibe Coding5 Sep 2026 · #01Diff Risk ReviewerRead a vibe-coded diff for behavior risk: what changed, what can break, and which check to run before you push.Indiff --git a/app/api/orders/route.ts b/app/api/orders/route.tsOutThe checkMedium Preview this drop
- 0:00 The intended changeOne sentence: checkout should trust the price the server already computed.
- 0:08 The hunk that movedThe reducer that summed item.price * qty is gone. total now comes from body.total.
- 0:16 The riskA client can post any total, including zero or a negative, and the route marks the order paid.
- 0:24 The checkSend the old cart fixture and assert the stored total matches the server sum, not the body.
No daily video for this drop yet. The in and out lines above are the preview.
Tomorrow's drop
Get tomorrow's agent in your inbox
One email when the drop goes up. No digest, no course. Unsubscribe whenever the provider lets you.
Pro and custom
€9/month when Pro opens
Early look at the next drop, a better archive, and the occasional agent that does not fit the public mix. The daily agent stays free. A custom build is €49–199. Nothing is charged from this form.
Join the Pro waitlist