Audit real security risks
Vibe Code Security Reviewer performs advanced evidence-based security reviews of AI-generated and rapidly built applications. It checks Supabase RLS, authentication, authorization, tenant isolation, API leaks and misuse, inputs, secrets, uploads, dependencies, data exposure, AI tools, deployment configuration, and abuse paths, then prioritizes findings with practical remediation and verification steps.
Skills 20 in the ChatGPT listing
Ai application security Review AI features for prompt injection, data leakage, tool abuse, unsafe output, and excessive agency. Api abuse and misuse Review APIs for broken object authorization, excessive data, unsafe methods, rate-limit gaps, and abuse paths. Api leak and key security Detect API keys, service credentials, tokens, and privileged endpoints leaked to clients or repositories. Authentication and authorization Review login, sessions, tokens, roles, permissions, tenant isolation, and privileged actions. Cloudflare and deployment security Review Workers, Pages, storage bindings, deployment configuration, and production security controls. Dependencies and supply chain Review packages, lockfiles, scripts, provenance, licensing, advisories, and dependency risk. Edge functions and webhooks Review serverless functions, webhooks, signatures, retries, idempotency, and privileged execution. Observability and incident response Review security logging, alerting, audit trails, containment, recovery, and post-incident evidence. Postgres database security Review PostgreSQL schemas, grants, functions, views, migrations, and query safety. Privacy and data governance Review collection, minimization, retention, consent, logging, export, deletion, and third-party data flows. Realtime and messaging security Review realtime channels, WebSockets, queues, broadcasts, subscriptions, and message authorization. Secrets and data protection Find exposed secrets and review sensitive-data collection, storage, logging, and transmission. Security review reporting Produce concise, evidence-backed security reports for developers and stakeholders. Security testing and remediation Convert findings into safe tests, prioritized fixes, regression coverage, and verification evidence. Storage and upload security Review object storage, file uploads, MIME validation, path ownership, malware risk, and download authorization. Supabase auth and sessions Review Supabase Auth identity, JWT claims, sessions, recovery, OAuth, and account lifecycle security. Supabase rls security Perform deep Supabase Row Level Security, Data API exposure, policy, view, function, and role analysis. Threat modeling Model assets, actors, trust boundaries, attack paths, and mitigations for an application. Vibe code security reviewer Route fast-built application reviews into focused threat, code, dependency, data, deployment, and remediation workflows. Web application security Review web applications for injection, XSS, CSRF, SSRF, unsafe redirects, uploads, and browser security weaknesses. 
WorkOS#447