Vibe Coding Security

Background

How do I keep moving fast with AI coding tools without quietly introducing security holes into my own projects?

This is a dated, sourced tracker of the attacks that actually hit people shipping with Cursor, Claude Code, Lovable, v0, Bolt, and Replit — each incident paired with a recovery playbook, so the gap between "compromised" and "noticed" is hours instead of weeks. The threat model changed: the old contract was a human reading the README before running npm install; the new one is an agent half-remembering a package and installing it with permission prompts skipped. That's how self-replicating supply-chain worms (Shai-Hulud), malicious MCP servers (the Postmark MCP that BCC'd every email), and prompt injection get in — usually noticed when the cloud bill arrives.

How It Works

I vibe-coded it (fittingly), then spent most of the effort hardening it. It's a security resource, so it has to hold up to the same scrutiny it asks of everything else. The build is deliberately low-maintenance and keeps running on its own:

• Data sources: security researchers, vendor disclosures, and incident write-ups, distilled into one dated, sourced file per incident under advisories/, plus recovery playbooks/ and hardening guides.
• Machine-readable by default: each advisory is markdown with structured frontmatter — severity, status, affected ecosystems, dates — and a concrete "am I affected?" check.
• Backend: a Python build renders the markdown into a site plus an llms.txt index, a JSON API, and an Atom feed, shipped to GitHub Pages by Actions on every push.
• 86 checks gate the deploy: a pytest suite runs on each push, including one test that fails the build outright if a secret is ever committed.
• Self-updating: a Claude Code skill runs tiered web sweeps — deep over 24h, lighter over 7d — and learns which sources actually produce hits, querying those first next run.

[View the Live Tracker] | [View the Code]