VibeSafe Starter — Your First Security Pack#

3 files. 2 minutes. No more "it works on my machine" disasters.

You vibe-code with AI agents. Cool. But here's what AI won't tell you: 67% of npm packages used in AI-generated projects have known vulnerabilities. The AI doesn't check. It just imports.

This starter pack catches the obvious stuff before it catches you.

What You're Risking (Right Now)#

Every time an AI agent writes npm install or pip install without checking:

RiskRealityKnown CVEsPublic vulnerabilities that attackers already exploitAbandoned packagesLast updated in 2022. No fixes coming.Credential leaks.env files committed to git. API keys in code.Supply chain attacksMalicious packages that look legitimateUnmaintained dependencies47% of npm packages have no active maintainer

One vulnerable dependency → your entire project is compromised.

The Fix (3 Files)#

1. .github/workflows/security.yml#

Drop this into any repo. Runs on every push.

2. audit.sh#

Run before npm install. Catches critical CVEs.

3. checklib.sh#

Check a library before adding it to your project.

---

Quick Start#

bash

# Clone into your project
git clone https://github.com/nerua1/vibe-safe-starter.git
cp vibe-safe-starter/.github/workflows/security.yml .github/workflows/
cp vibe-safe-starter/audit.sh .
cp vibe-safe-starter/checklib.sh .
chmod +x audit.sh checklib.sh

# Check a library before installing
./checklib.sh react
./checklib.sh flask

# Audit your dependencies
./audit.sh

---

The Numbers#

• 67% of AI-suggested npm packages have known vulnerabilities
• 47% of npm packages are unmaintained
• 1 in 10 GitHub repos leak credentials
• Average CVE goes undetected for 208 days before disclosure

Your AI agent will happily install all of them. This pack won't.

---

Extend It#

This is the minimum. If you want more:

NeedSolutionVS Code integrationVibeSafe ExtensionAI-powered risk explanationVibeSafe AI ExplainMulti-agent HARNESSVibeSafe HARNESS §14Full audit pipelineVibeSafe FullDashboardvibe-safe/tools/dashboard.py --html

---

Philosophy#

• 80/20 rule: Catch 80% of risks with 20% of effort
• Non-blocking: Suggests, doesn't block your flow
• Zero config: Drop in, works immediately
• Minimal: 3 files. No frameworks. No databases.

---

Built by nerua1. ⭐ Star if this saves you from a security incident.

☕ PayPal.me/nerudek