VibeSecure

VibeSecure is an AI-native security control plane that turns vulnerability evidence into attack paths, fraud/impersonation impact, actionable fixes, and re-scan verification.

Comment

Inspiration

AI coding tools have made it dramatically easier to build software, but they have also made it easier to ship security mistakes at the same speed.

A developer can generate an application with authentication, APIs, databases, payments, and third-party integrations in minutes. The problem is that a vulnerability report saying "missing authorization" or "secret exposed" does not necessarily explain what that means to a real user or business.

We wanted to answer a more useful question:

"If this vulnerability is real, how could an attacker abuse it, who could be affected, and what happens after we fix it?"

That became the motivation for VibeSecure.

What it does

VibeSecure scans AI-built applications and turns deterministic security findings into an understandable security story:

Scan → Attack Path → Fraud Impact → Fix → Verify

Instead of stopping at a list of vulnerabilities, VibeSecure maps security evidence to potential real-world abuse scenarios.

For example:

Missing authorization

→ attacker reaches a protected resource

→ victim-scoped data or actions become accessible

→ attacker can act outside their own account

→ potential impersonation, transaction manipulation, privacy abuse, or fraud.

The product also analyzes exposed credentials, CORS weaknesses, unsafe HTML injection, SQL injection patterns, Supabase/RLS configuration, and other security controls.

Each finding can include:

  • severity
  • evidence
  • attack path
  • potential fraud/scam impact
  • confidence
  • recommended remediation
  • verification state

VibeSecure also evaluates a 15-control security hardening checklist and explicitly distinguishes between a detected issue, no matching finding, and controls that have not been verified.

Most importantly, the workflow does not end at "fix it."

A developer can apply the generated remediation, run VibeSecure again, and verify whether the previous finding signature has been resolved.

How we built it

VibeSecure uses a layered architecture.

1. Deterministic security evidence

The scanner layer analyzes source repositories and application configuration for security issues such as exposed secrets, Supabase/RLS weaknesses, CORS problems, static-analysis vulnerabilities, and hardening risks.

Deterministic scanner evidence remains the source of truth.

2. Fraud impact reasoning

We built a fraud-risk layer that maps security evidence to conservative abuse scenarios.

For example:

Missing authorization

→ Unauthorized access

→ Victim data/action exposure

→ Account manipulation

→ Impersonation / fraud risk

The impact is explicitly presented as an inferred scenario. VibeSecure does not claim that an application was successfully exploited unless separate dynamic evidence proves it.

3. Attack Impact Graph

The dashboard converts a finding into a visual attack path showing how an attacker could potentially move from a security weakness toward a business impact.

This helps developers and non-security users understand why a vulnerability matters.

4. Security hardening

VibeSecure evaluates 15 security controls covering areas such as:

  • secrets and API keys
  • environment-file protection
  • authentication
  • authorization/RLS
  • SQL injection
  • XSS
  • CORS
  • security headers
  • CSRF
  • secure cookies
  • rate limiting
  • file uploads
  • dependency hygiene
  • client-side trust
  • security logging

"No finding" is deliberately not presented as proof of security.

5. AI assistance

AI is used for grounded explanation and remediation wording rather than replacing the evidence engine.

This keeps the system evidence-first while making security findings easier to understand and act upon.

6. Verification loop

After remediation, the repository can be scanned again.

Resolved finding signatures are compared against the previous scan so developers can see whether the security issue was actually cleared.

7. MCP integration

VibeSecure also exposes its security workflow through MCP so AI coding environments can interact with the security system directly.

The goal is to bring security into the developer's existing AI-assisted workflow instead of requiring developers to leave their coding environment.

Challenges we ran into

One of the biggest challenges was avoiding the temptation to make the product look smarter than the evidence actually supports.

A security scanner can detect a missing authorization check, but that does not automatically prove account takeover occurred.

We therefore designed the fraud-impact system conservatively. It separates deterministic evidence from inferred impact and clearly labels confidence and assumptions.

Another challenge was making the workflow understandable without overwhelming developers with security terminology. We addressed this by turning individual findings into attack paths and business-impact explanations.

We also had to make the application work as a real deployed system rather than only as a local prototype, including the frontend, backend API, database, scanning jobs, MCP integration, and re-scan verification.

Accomplishments that we're proud of

We are proud that VibeSecure goes beyond a traditional vulnerability list.

During ForgeHacks, we added the ability to connect security findings to potential fraud and impersonation scenarios, visualize attack paths, evaluate security hardening controls, and close the loop with remediation and verification.

In a real test against an AI-built repository, VibeSecure identified 13 high/critical findings and produced a critical fraud-risk assessment, including exposed credentials, CORS misconfiguration, unsafe HTML injection, and disabled Supabase Row-Level Security.

The resulting workflow was:

Repository → Evidence → Attack Path → Fraud Impact → Fix → Re-scan → Verify

We also made the system explicit about uncertainty: inferred fraud impact is not presented as proof of exploitation.

What we learned

We learned that security findings become much more actionable when they are connected to outcomes people actually understand.

"Missing authorization" is a technical statement.

"An attacker may reach another user's data and perform actions outside their own account" is a security story.

We also learned that AI is most useful here when it sits on top of trustworthy evidence rather than inventing security conclusions.

Finally, building the entire workflow taught us that security products need verification loops. Finding a problem is only the first step; proving that the problem was addressed is equally important.

What's next for VibeSecure

Our longer-term goal is to build VibeSecure into a security control plane for AI-native software teams.

The next stage is to continuously observe what AI coding agents introduce, reason about the resulting attack paths, help developers fix them, and verify the result automatically.

We envision VibeSecure working across AI coding environments and development workflows through MCP and other integrations.

The long-term product loop is:

Observe → Reason → Act → Verify

Our goal is simple:

Let teams build with AI at full speed without leaving security behind.

ForgeHacks Build Scope

VibeSecure began as an existing AI-assisted software security project. For ForgeHacks, we substantially extended the project with the fraud/scam impact analysis layer, Attack Impact Graph, 15-control security hardening assessment, remediation-to-verification workflow, and the corresponding security command-center experience.

The submission focuses on these ForgeHacks additions and demonstrates them running as part of the deployed VibeSecure system.

Built With

Share this project:

Updates

Submission history