Vibe Coding Security Audit
Security audit for AI-built apps: exposed API keys, NEXT_PUBLIC secrets, Supabase service_role, open API routes, Stripe webhooks, CORS. Grade + fixes. $29.
View Vibe Coding Security Audit
Find the leaked key, the open Supabase table and the root container before your users do.

Security audit for AI-built apps: exposed API keys, NEXT_PUBLIC secrets, Supabase service_role, open API routes, Stripe webhooks, CORS. Grade + fixes. $29.
View Vibe Coding Security AuditSupabase RLS checker for migrations: tables without RLS, using (true) policies, user_metadata, slow auth.uid(), definer views. Fix SQL included. $19.
View Supabase RLS CheckerDockerfile linter with fixes: non-root user, pinned slim images, secrets in ENV/ARG, apt cache, COPY order, .dockerignore. SARIF + Claude Code skill. $19.
View Dockerfile Linter & Best Practices CheckerThree pre-launch checks for apps built fast (with Cursor, Claude Code, Lovable, Bolt or by hand), each a local Python tool with a Claude Code skill and CI or pre-commit setup.
| Folder | What it does |
|---|---|
| plugins/vibe-coding-security-audit/ | scans the code for the mistakes AI-built apps ship with: secrets in the frontend, open CORS, API routes without auth, unverified webhooks, SQL injection and more; graded A-F |
| plugins/supabase-rls-checker/ | checks Supabase migrations for Row Level Security problems before deploy and writes the fix migration |
| plugins/dockerfile-linter/ | lints Dockerfiles: root user, unpinned images, secrets in layers, cache-busting order, shell-form CMD; graded A-F |
./run_tests.sh # runs every tool's tests
./demo.sh # runs each tool on its example projectBought separately: $29 + $19 + $19 = $67.
The screenshot is real output from the kit’s own commands. Tested from a fresh download of this exact zip: ./run_tests.sh passed on Python 3.13 and 3.10.

/plugin marketplace add ./ship-safe-security-bundle
/plugin install supabase-rls-checker@youraitools-shipsafeAutomated checks find common, known mistakes; they are not a penetration test or a security audit by a person. The limits in each tool's README apply.
Zip, 62 KB, v1.0, 62 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with or endorsed by Vercel, Supabase, Stripe, Docker or any vendor.
3 pre-launch security checks: vibe coding security audit, Supabase RLS checker, Dockerfile linter. Local, CI-ready, Claude Code skills. $45 ($67 separately).
Free GitHub Actions security checker: script injection, pull_request_target, unpinned actions, token permissions and secrets, with fixes. Offline, SARIF.
View GitHub Actions Security Checker (Free)Free schema markup validator: check JSON-LD against Google's rich result rules, spot retired FAQ and HowTo markup, bad prices and dates. Files, folders or URLs.
View Free Schema Markup ValidatorFree read-only Postgres health check: invalid indexes, wraparound, sequences near limit, missing FK indexes, duplicate indexes and more. Markdown or JSON.
View Postgres Health Check (Free)Short weekly digest of new x402 + MCP tools and free kits, including the MCP OAuth Checker. No spam, unsubscribe any time.