Vibe-coded products can ship quickly, but solo builders rarely get the security review loop that established engineering teams rely on. Deadbolt is a defensive blue-team product for source repositories a user owns or is explicitly authorized to audit. It turns a vague request—“is this secure?”—into a structured workflow: threat model the code, hunt through independent security lenses, attach evidence and human stakes to each finding, recommend a focused fix, and state exactly what was or was not verified.
The primary, judge-testable surface is the keyless $deadbolt Codex Skill. A signed-in Codex user can install the bundled plugin and ask it to audit local source code without a separate API key. The Skill is intentionally read-only: it builds a compact threat model, examines secrets, authorization/IDOR, input-to-sink, and configuration risks, and returns only evidence-backed findings with precise source locations. When a user asks for a fix, it supplies remediation recommendations without pretending it edited code or verified a patch.
Deadbolt also includes a separate Next.js TypeScript engine that models the fuller hunt → patch → re-analysis product workflow through the OpenAI Responses API and structured outputs. It applies focused patch plans only to an isolated in-memory clone and re-runs the affected hunt lens against that clone. This submission is deliberately precise: the web engine requires an API key, and no live key-backed run is represented as verified. The keyless Skill does not claim to be that engine.
Codex drove the plugin package, security-lens architecture, source-intake controls, report contracts, patch safeguards, and verification suite. GPT-5.6 informs the model-backed engine design and authorship workflow. The repository includes an intentionally vulnerable synthetic sample, a blind-audit prompt that prevents the model from reading its answer key, a public installation walkthrough, and a complete validation trail.
Built With
- codex
- gpt-5.6
- next.js
- openai-responses-api
- typescript
- vercel
- zod
Log in or sign up for Devpost to join the conversation.