plugin

Vibe Code Security Reviewer

Audit real security risks

Vibe Code Security Reviewer performs advanced evidence-based security reviews of AI-generated and rapidly built applications. It checks Supabase RLS, authentication, authorization, tenant isolation, API leaks and misuse, inputs, secrets, uploads, dependencies, data exposure, AI tools, deployment configuration, and abuse paths, then prioritizes findings with practical remediation and verification steps.

Install

1Add it in ChatGPT
Open Plugins in the ChatGPT sidebar (web or desktop), search for “Vibe Code Security Reviewer” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

Skills 15

ai-application-security
Review AI features for prompt injection, data leakage, tool abuse, unsafe output, and excessive agency.
api-abuse-and-misuse
Review APIs for broken object authorization, excessive data, unsafe methods, rate-limit gaps, and abuse paths.
api-leak-and-key-security
Detect API keys, service credentials, tokens, and privileged endpoints leaked to clients or repositories.
authentication-and-authorization
Review login, sessions, tokens, roles, permissions, tenant isolation, and privileged actions.
cloudflare-and-deployment-security
Review Workers, Pages, storage bindings, deployment configuration, and production security controls.
dependencies-and-supply-chain
Review packages, lockfiles, scripts, provenance, licensing, advisories, and dependency risk.
edge-functions-and-webhooks
Review serverless functions, webhooks, signatures, retries, idempotency, and privileged execution.
observability-and-incident-response
Review security logging, alerting, audit trails, containment, recovery, and post-incident evidence.
postgres-database-security
Review PostgreSQL schemas, grants, functions, views, migrations, and query safety.
privacy-and-data-governance
Review collection, minimization, retention, consent, logging, export, deletion, and third-party data flows.
realtime-and-messaging-security
Review realtime channels, WebSockets, queues, broadcasts, subscriptions, and message authorization.
secrets-and-data-protection
Find exposed secrets and review sensitive-data collection, storage, logging, and transmission.
security-review-reporting
Produce concise, evidence-backed security reports for developers and stakeholders.
security-testing-and-remediation
Convert findings into safe tests, prioritized fixes, regression coverage, and verification evidence.
storage-and-upload-security
Review object storage, file uploads, MIME validation, path ownership, malware risk, and download authorization.